Vulnerability record/PUBLISHED/Published Jul 31, 2024 13:17:30 UTC
CVE-2024-31201
A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could be abused in scenarios where incorrect permissions were assigned to the C:\ path to attempt a privilege escalation on the local machine.
Base score6.5/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorLocalAV
Attack complexityLowAC
Privileges requiredHighPR
User interactionRequiredUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactHighI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityNozomi
Last updatedAug 1, 2024 14:52:47 UTC
PublishedJul 31, 2024 13:17:30 UTC
ReservedMar 29, 2024 08:32:14 UTC
Credits
- Diego Zaffaroni of Nozomi Networks found this bug during a security research activity.