Vulnerability · Published Apr 11, 2025 · Assigned by Sophos
CVE-2024-13861
High 7.8
In plain English
A high-severity incorrect permission assignment in Taegis Endpoint Agent (Linux) from Sophos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 89.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code execution as root. Redhat-based systems using RPM packages are not affected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sophos | Taegis Endpoint Agent (Linux) | 0 – before 1.3.10 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H