CVE-2024-24912

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-24912", "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "state": "PUBLISHED", "assignerShortName": "checkpoint", "dateReserved": "2024-02-01T15:19:26.278Z", "datePublished": "2024-05-01T13:22:48.486Z", "dateUpdated": "2024-08-01T23:36:20.217Z"}, "containers": {"cna": {"affected": [{"product": "Harmony Endpoint Security Client for Windows", "vendor": "checkpoint", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "Harmony Endpoint Security Client for Windows versions E88.10 and below"}]}], "title": "Local privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL file", "descriptions": [{"lang": "en", "value": "A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target system."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "shortName": "checkpoint", "dateUpdated": "2024-05-01T13:22:48.486Z"}, "credits": [{"lang": "en", "value": "Kolja Grassmann (Cirosec GmbH)", "type": "finder"}, {"lang": "en", "value": "Alain R\u00f6del (Neodyme)", "type": "finder"}], "references": [{"url": "https://support.checkpoint.com/results/sk/sk182244"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-24912", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-01T17:15:29.343054Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:checkpoint:harmony_endpoint:e83:*:*:*:*:*:*:*"], "vendor": "checkpoint", "product": "harmony_endpoint", "versions": [{"status": "affected", "version": "e88.10"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:43:34.409Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:20.217Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.checkpoint.com/results/sk/sk182244", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.checkpoint.com/results/sk/sk182244", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:20.217Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-24912", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-01T17:15:29.343054Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:checkpoint:harmony_endpoint:e83:*:*:*:*:*:*:*"], "vendor": "checkpoint", "product": "harmony_endpoint", "versions": [{"status": "affected", "version": "e88.10"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-01T17:15:00.627Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Local privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL file", "credits": [{"lang": "en", "type": "finder", "value": "Kolja Grassmann (Cirosec GmbH)"}, {"lang": "en", "type": "finder", "value": "Alain R\u00f6del (Neodyme)"}], "affected": [{"vendor": "checkpoint", "product": "Harmony Endpoint Security Client for Windows", "versions": [{"status": "affected", "version": "Harmony Endpoint Security Client for Windows versions E88.10 and below"}], "platforms": ["Windows"]}], "references": [{"url": "https://support.checkpoint.com/results/sk/sk182244"}], "descriptions": [{"lang": "en", "value": "A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "shortName": "checkpoint", "dateUpdated": "2024-05-01T13:22:48.486Z"}}}, "cveMetadata": {"cveId": "CVE-2024-24912", "state": "PUBLISHED", "dateUpdated": "2024-08-01T23:36:20.217Z", "dateReserved": "2024-02-01T15:19:26.278Z", "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "datePublished": "2024-05-01T13:22:48.486Z", "assignerShortName": "checkpoint"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"platforms": ["Windows"], "product": "Harmony Endpoint Security Client for Windows", "vendor": "checkpoint", "versions": [{"status": "affected", "version": "Harmony Endpoint Security Client for Windows versions E88.10 and below"}]}], "source": "cve@checkpoint.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:checkpoint:harmony_endpoint:e83:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "harmony_endpoint", "vendor": "checkpoint", "versions": [{"status": "affected", "version": "e88.10"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:checkpoint:harmony_endpoint:*:*:*:*:*:*:*:*", "matchCriteriaId": "D44FC008-EC3F-4B63-B512-7D1C79A59C7B", "versionEndExcluding": "e88.20", "versionStartIncluding": "e86.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target system."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad de escalada de privilegios local en Harmony Endpoint Security Client para las versiones E88.10 y anteriores de Windows. Para aprovechar esta vulnerabilidad, un atacante primero debe obtener la capacidad de ejecutar c\u00f3digo privilegiado local en el sistema de destino."}], "id": "CVE-2024-24912", "lastModified": "2026-06-17T07:15:12.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-24912", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-05-01T17:15:29.343054Z", "version": "2.0.3"}}]}, "published": "2024-05-01T14:15:06.323", "references": [{"source": "cve@checkpoint.com", "tags": ["Vendor Advisory"], "url": "https://support.checkpoint.com/results/sk/sk182244"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.checkpoint.com/results/sk/sk182244"}], "sourceIdentifier": "cve@checkpoint.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "cve@checkpoint.com", "type": "Secondary"}]}

{}

{}