CVE-2024-9494

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

DLL hijacking vulnerabilities, caused by an uncontrolled search path in the 

CP210 VCP Win 2k

installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published
Jan 24, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-94958.6DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows installer can lead to privilege escalatiCVE-2024-94968.6DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit installer can lead to privilege escalatCVE-2024-94978.6DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalatioCVE-2024-94988.6DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK installer can lead to privilege escalation CVE-2024-94998.6DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalCVE-2024-95007.8A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalatCVE-2024-95019.8The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and incluCVE-2024-95025.4The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulneraCVE-2024-95034.3The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing caCVE-2024-95047.2The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in aCVE-2024-95055.4The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widgetCVE-2024-95063.7Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.
CVE-2024-9494: High severity, CVSS 8.6 | Vulnix