CVE-2024-25724

Katalog CVE

CVSS 7.3 · High EPSS 0,18%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada rti connext professional. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service allows attackers to execute code with the affected service's privileges, compromise the service's integrity, leak sensitive information, or crash the service. These attacks could be done via a remote malicious RTPS message; a compromised call with malicious parameters to the RTI_RoutingService_new, rti::recording::Service, RTI_QueuingService_new, or RTI_CDS_Service_new public APIs; or a compromised local file system containing a malicious XML file.

Rincian

Terbit di NVD

21 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://community.rti.com/static/documentation/connext-dds/current/doc/vulnerabilities/index.html#cve-2024-257... advisory vendor