Vulnerability details
CVE-2024-12903
Biamp Evoko Home Service
Incorrect default permissions in Biamp Evoko Home
CVSS 3.1
7.8High
Official description
Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control permissions exist on the ‘Everyone’ group (i.e. any user who has local access to the operating system regardless of their privileges).
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.8High | 3.1 | CVEProject cvelistV5 (CNA) (INCIBE) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Biamp | Evoko Home Service | 2.4.2 ≤ v ≤ 2.7.4. | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2024-12-23
- Last updated
- 2024-12-24
- State
- Published
- Assigner (CNA)
- INCIBE
Exploit prediction (EPSS)
0.19%
Probability of exploitation in 30 days
9.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-276Incorrect Default Permissions