CVE-2024-36291

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Uncontrolled search path for some Intel(R) Chipset Software Installation Utility before version 10.1.19867.8574 may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Feb 12, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-362927.3Improper buffer restrictions for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an auth CVE-2024-362936.5Improper access control in the EDECCSSA user leaf function for some Intel(R) Processors with Intel(R) SGX may allow an authenticated user to CVE-2024-362947.8Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user to potentially enable CVE-2024-362957.2A command execution vulnerability exists in the qos.cgi qos_sta() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HT CVE-2024-36305.4The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2024-363027.8An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte CVE-2024-363037.8An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte CVE-2024-363047.0A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escala CVE-2024-363057.8A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal CVE-2024-363065.5A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to c CVE-2024-363075.5A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sen CVE-2024-36314.3The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to m