CVE-2024-26291

Description

An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allowing users to read arbitrary files. As the application runs with the highest privileges (root/NT_AUTHORITY SYSTEM) by default attackers are able to obtain sensitive information. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.

Reserved 2024-02-16 | Published 2025-07-14 | Updated 2025-07-14 | Assigner ENISA

GENERAL AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-285: Improper Authorization

Product status

Default status
unaffected

Any version before 2025.5.1
affected

Default status
unaffected

Any version before 2025.5.1
affected

Default status
unaffected

Any version before 2025.5.1
affected

Default status
unaffected

Any version before 2025.5.1
affected

Credits

DriveByte finder

CERT-Bund coordinator

References

resources.avid.com/...vidNEXIS/AvidNEXIS_2025_5_1_ReadMe.pdf vendor-advisory

raeph123.github.io/...Agent_Multiple_Vulnerabilities_en.html third-party-advisory technical-description

cve.org (CVE-2024-26291)

nvd.nist.gov (CVE-2024-26291)

Download JSON