CVE-2024-26289

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
PMB Services	PMB	>= 7.5.1, < 7.5.6-2; >= 7.4.1, < 7.4.9; >= 7.3.1, < 7.3.18
pmb_services	pmb	>= 7.5.1, < 7.5.6-2; >= 7.4.1, < 7.4.9; >= 7.3.1, < 7.3.18

References

https://forge.sigb.net/projects/pmb/filesProduct
https://github.com/enisaeu/CNW/blob/main/advisories/2024/CNW-2024-A-12.mdThird Party Advisory
https://forge.sigb.net/projects/pmb/filesProduct
https://github.com/enisaeu/CNW/blob/main/advisories/2024/CNW-2024-A-12.mdThird Party Advisory

Timeline

Published: May 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-26294.3Incorrect security UI in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML pag CVE-2024-262908.7Improper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Lin CVE-2024-262918.7An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate CVE-2024-262927.1An authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files. This issue affects Avid NEXIS E-series:CVE-2024-262938.7The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to CVE-2024-262948.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262958.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262968.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262978.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262988.8Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on CVE-2024-262994.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a CVE-2024-26306.5Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafte