CVE-2024-42017

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenario, if the application is remotely accessible, it allows an attacker to execute arbitrary commands with system privilege on the endpoint hosting the application, without any authentication.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-420187.7An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved CVE-2024-420198.0A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user int CVE-2024-42028.6In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiati CVE-2024-420205.4A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.CVE-2024-420216.5An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.CVE-2024-420225.3An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.CVE-2024-420238.8An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely.CVE-2024-420248.8A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on CVE-2024-420257.8A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and ea CVE-2024-420276.7The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they hav CVE-2024-420288.8A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and ea CVE-2024-420296.3xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single