CVE-2024-52065

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-52065", "assignerOrgId": "3f572a00-62e2-4423-959a-7ea25eff1638", "state": "PUBLISHED", "assignerShortName": "RTI", "dateReserved": "2024-11-05T19:04:16.676Z", "datePublished": "2024-12-13T10:22:34.728Z", "dateUpdated": "2025-02-07T21:49:18.883Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Persistence Service"], "platforms": ["non-Windows"], "product": "Connext Professional", "vendor": "RTI", "versions": [{"lessThan": "7.3.0.2", "status": "affected", "version": "7.0.0", "versionType": "custom"}, {"lessThan": "6.1.2.21", "status": "affected", "version": "6.1.1.2", "versionType": "custom"}, {"lessThan": "5.3.1.41", "status": "affected", "version": "5.3.1.40", "versionType": "custom"}]}], "datePublic": "2024-12-12T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment Variables.<p>This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.1.2 before 6.1.2.21, from 5.3.1.40 before 5.3.1.41.</p>"}], "value": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.1.2 before 6.1.2.21, from 5.3.1.40 before 5.3.1.41."}], "impacts": [{"capecId": "CAPEC-10", "descriptions": [{"lang": "en", "value": "CAPEC-10 Buffer Overflow via Environment Variables"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3f572a00-62e2-4423-959a-7ea25eff1638", "shortName": "RTI", "dateUpdated": "2025-02-07T21:49:18.883Z"}, "references": [{"url": "https://www.rti.com/vulnerabilities/#cve-2024-52065"}], "source": {"discovery": "UNKNOWN"}, "title": "Potential stack buffer write overflow in Persistence Service while parsing malicious environment variable on non-Windows systems", "x_generator": {"engine": "Vulnogram 0.2.0"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negated": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.3.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.1.2", "versionEndExcluding": "6.1.2.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3.1.40", "versionEndExcluding": "5.3.1.41"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-16T18:15:10.198168Z", "id": "CVE-2024-52065", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-16T18:15:14.557Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-52065", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-16T18:15:10.198168Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-16T18:15:07.026Z"}}], "cna": {"title": "Potential stack buffer write overflow in Persistence Service while parsing malicious environment variable on non-Windows systems", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-10", "descriptions": [{"lang": "en", "value": "CAPEC-10 Buffer Overflow via Environment Variables"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "RTI", "modules": ["Persistence Service"], "product": "Connext Professional", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.3.0.2", "versionType": "custom"}, {"status": "affected", "version": "6.1.1.2", "lessThan": "6.1.2.21", "versionType": "custom"}, {"status": "affected", "version": "5.3.1.40", "lessThan": "5.3.1.41", "versionType": "custom"}], "platforms": ["non-Windows"], "defaultStatus": "unaffected"}], "datePublic": "2024-12-12T16:00:00.000Z", "references": [{"url": "https://www.rti.com/vulnerabilities/#cve-2024-52065"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.1.2 before 6.1.2.21, from 5.3.1.40 before 5.3.1.41.", "supportingMedia": [{"type": "text/html", "value": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment Variables.<p>This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.1.2 before 6.1.2.21, from 5.3.1.40 before 5.3.1.41.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "cpeApplicability": [{"nodes": [{"negated": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.3.0.2", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.2.21", "versionStartIncluding": "6.1.1.2"}, {"criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.3.1.41", "versionStartIncluding": "5.3.1.40"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "3f572a00-62e2-4423-959a-7ea25eff1638", "shortName": "RTI", "dateUpdated": "2025-02-07T21:49:18.883Z"}}}, "cveMetadata": {"cveId": "CVE-2024-52065", "state": "PUBLISHED", "dateUpdated": "2025-02-07T21:49:18.883Z", "dateReserved": "2024-11-05T19:04:16.676Z", "assignerOrgId": "3f572a00-62e2-4423-959a-7ea25eff1638", "datePublished": "2024-12-13T10:22:34.728Z", "assignerShortName": "RTI"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Persistence Service"], "platforms": ["non-Windows"], "product": "Connext Professional", "vendor": "RTI", "versions": [{"lessThan": "7.3.0.2", "status": "affected", "version": "7.0.0", "versionType": "custom"}, {"lessThan": "6.1.2.21", "status": "affected", "version": "6.1.1.2", "versionType": "custom"}, {"lessThan": "5.3.1.41", "status": "affected", "version": "5.3.1.40", "versionType": "custom"}]}], "source": "3f572a00-62e2-4423-959a-7ea25eff1638"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "matchCriteriaId": "E65F0020-14AC-4966-AAF2-97A73FF72FF4", "versionEndExcluding": "6.1.2.21", "versionStartIncluding": "6.1.1.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*", "matchCriteriaId": "F3ED9A74-6AA2-45B2-8473-9B7FF2882C55", "versionEndExcluding": "7.3.0.2", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rti:connext_professional:5.3.1.40:*:*:*:*:*:*:*", "matchCriteriaId": "9C73C9B5-FE5C-483E-8FD2-A18E6A318CC6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from 6.1.1.2 before 6.1.2.21, from 5.3.1.40 before 5.3.1.41."}, {"lang": "es", "value": "La vulnerabilidad de copia de b\u00fafer sin comprobar el tama\u00f1o de la entrada ('desbordamiento de b\u00fafer cl\u00e1sico') en RTI Connext Professional en sistemas que no son Windows (servicio de persistencia) permite un desbordamiento de b\u00fafer a trav\u00e9s de variables de entorno. Este problema afecta a Connext Professional: desde la versi\u00f3n 7.0.0 hasta la 7.3.0.2, desde la versi\u00f3n 6.1.1.2 hasta la 6.1.2.21, desde la versi\u00f3n 5.3.1.40 hasta la 5.3.1.41."}], "id": "CVE-2024-52065", "lastModified": "2026-06-17T08:06:54.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "3f572a00-62e2-4423-959a-7ea25eff1638", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-52065", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-12-16T18:15:10.198168Z", "version": "2.0.3"}}]}, "published": "2024-12-13T11:15:09.153", "references": [{"source": "3f572a00-62e2-4423-959a-7ea25eff1638", "tags": ["Vendor Advisory"], "url": "https://www.rti.com/vulnerabilities/#cve-2024-52065"}], "sourceIdentifier": "3f572a00-62e2-4423-959a-7ea25eff1638", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "3f572a00-62e2-4423-959a-7ea25eff1638", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-07-12T15:42:30.730335+00:00", "updated": "2025-07-12T15:42:30.730380+00:00", "vendors": ["rti", "rti$PRODUCT$connext_professional"]}