CVE-2024-26293 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.

Reserved 2024-02-16 | Published 2025-07-14 | Updated 2025-07-14 | Assigner ENISA

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-1395: Dependency on Vulnerable Third-Party Component

Product status

Default status

unaffected

Any version before 2025.5.1

affected

Default status

unaffected

Any version before 2025.5.1

affected

Default status

unaffected

Any version before 2025.5.1

affected

Default status

unaffected

Any version before 2025.5.1

affected

Credits

DriveByte finder

CERT-Bund coordinator

References

resources.avid.com/...vidNEXIS/AvidNEXIS_2025_5_1_ReadMe.pdf vendor-advisory

raeph123.github.io/...Agent_Multiple_Vulnerabilities_en.html third-party-advisory technical-description

www.genivia.com/changelog.html third-party-advisory

cve.org (CVE-2024-26293)

nvd.nist.gov (CVE-2024-26293)

Download JSON

https://cve.threatint.eu/CVE/CVE-2024-26293

Support options

Helpdesk Chat, Email, Knowledgebase