Log in Start free

Vulnerability · Published May 21, 2024 · Assigned by mitre

CVE-2024-25724

High 7.3

In plain English

A high-severity buffer overflow in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.2%top 92.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service allows attackers to execute code with the affected service's privileges, compromise the service's integrity, leak sensitive information, or crash the service. These attacks could be done via a remote malicious RTPS message; a compromised call with malicious parameters to the RTI_RoutingService_new, rti::recording::Service, RTI_QueuingService_new, or RTI_CDS_Service_new public APIs; or a compromised local file system containing a malicious XML file.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-120 · Vector: CVSS:3.1/AC:L/AV:L/A:H/C:L/I:H/PR:L/S:U/UI:N

References