PT-2025-3737 · Forescout · Forescout Secureconnector

Owen Jeanes · Published 2025-01-02 · Updated 2025-10-17 · CVE-2024-9950

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Forescout SecureConnector version 11.3.07.0109

Description A vulnerability in Forescout SecureConnector allows unauthenticated users to modify compliance scripts due to an insecure temporary directory. This issue enables unauthorized modification of scripts, potentially leading to security breaches.

Recommendations For Forescout SecureConnector version 11.3.07.0109, consider restricting access to the temporary directory to prevent unauthorized script modifications until a patch is available. As a temporary workaround, disabling the ability for unauthenticated users to modify compliance scripts can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-379

Related Identifiers

CVE-2024-9950

Affected Products

Forescout Secureconnector

References · 10

• https://support.forescout.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9950 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9950 · Vendor Advisory
• https://t.me/cvenotify/106022 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1874931599575249390 · Twitter Post
• https://t.me/cveNotify/139222 · Telegram Post
• https://t.me/cveNotify/137644 · Telegram Post
• https://t.me/cvedetector/14179 · Telegram Post
• https://twitter.com/CVEnew/status/1875033746019168378 · Twitter Post
• https://twitter.com/CveFindCom/status/1874848743645692036 · Twitter Post