Vulnerability · Published Nov 28, 2024 · Assigned by INCIBE
CVE-2024-11969Incorrect default permissions in Cradlepoint NetCloud Exchange
High 8.8
In plain English
A high-severity incorrect default permissions in NetCloud Exchange Client from Cradlepoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
The NetCloud Exchange client for Windows, version 1.110.50, contains an insecure file and folder permissions vulnerability. A normal (non-admin) user could exploit the weakness in file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control permissions exist on the ‘Everyone’ group (i.e. any user who has local access to the operating system regardless of their privileges).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cradlepoint | NetCloud Exchange Client | 1.110.50 |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H