Vulnerability · Published Dec 23, 2024 · Assigned by INCIBE
CVE-2024-12903Incorrect default permissions in Biamp Evoko Home
High 7.8
In plain English
A high-severity incorrect default permissions in Evoko Home Service from Biamp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control permissions exist on the ‘Everyone’ group (i.e. any user who has local access to the operating system regardless of their privileges).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Biamp | Evoko Home Service | 2.4.2 – through 2.7.4. |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H