PT-2025-3163 · Microsoft+1 · Windows+2

Published 2025-01-22 · Updated 2025-03-12 · CVE-2024-55957

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thermo Fisher Scientific Xcalibur versions prior to 4.7 SP1 Thermo Foundation Instrument Control Software (ICSW) versions prior to 3.1 SP10

Description The issue is related to a local privilege escalation vulnerability due to improper access control permissions on Windows systems. This vulnerability affects the driver packages in the mentioned software.

Recommendations For Thermo Fisher Scientific Xcalibur versions prior to 4.7 SP1, update to version 4.7 SP1 or later. For Thermo Foundation Instrument Control Software (ICSW) versions prior to 3.1 SP10, update to version 3.1 SP10 or later.

Fix

Incorrect Authorization

Incorrect Default Permissions

Weakness Enumeration

CWE-863

CWE-276

Related Identifiers

CVE-2024-55957

Affected Products

Thermo Fisher Scientific Xcalibur

Thermo Foundation Instrument Control

Windows

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-55957 · Security Note
• https://twitter.com/CVEnew/status/1882300225101910170 · Twitter Post
• https://thermofisher.com · Note
• https://t.me/defcon_news/128735 · Telegram Post
• https://twitter.com/reverseame/status/1899911049840562282 · Twitter Post
• https://assets.thermofisher.com/TFS-Assets/CORP/Product-Guides/Thermo_Scientific_Xcalibur_and_Foundation.pdf · Note
• https://t.me/secharvester/18188 · Telegram Post
• https://t.me/cvedetector/16137 · Telegram Post
• https://t.me/rnetsec/21224 · Telegram Post