« Volver al listado

CVE-2024-8258

Estado: AnalizadaBaja (2)—

El control inadecuado de la generación de código ('inyección de código') en Electron Fuses en Logitech Options Plus versión 1.60.496306 en macOS permite a los atacantes ejecutar código arbitrario a través de una configuración insegura de Electron Fuses.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Logitech — Logi Options+

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8258",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8258",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-10T13:54:25.415583Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cve-coordination@logitech.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 2,
          "Automatable": "YES",
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cve-coordination@logitech.com",
      "affectedData": [
        {
          "vendor": "Logitech",
          "product": "Logitech Options Plus",
          "versions": [
            {
              "status": "affected",
              "version": "1.60.496306",
              "lessThan": "1.70",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.70"
            }
          ],
          "platforms": [
            "MacOS"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:logitech:options_plus:*:*:*:*:*:*:*:*"
          ],
          "vendor": "logitech",
          "product": "options_plus",
          "versions": [
            {
              "status": "affected",
              "version": "1.60.496306",
              "lessThan": "1.70",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-09-10T09:15:07.497",
  "references": [
    {
      "url": "https://github.com/r3ggi/electroniz3r",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve-coordination@logitech.com"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49314",
      "tags": [
        "Not Applicable"
      ],
      "source": "cve-coordination@logitech.com"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50643",
      "tags": [
        "Not Applicable"
      ],
      "source": "cve-coordination@logitech.com"
    },
    {
      "url": "https://www.electronjs.org/docs/latest/tutorial/fuses",
      "tags": [
        "Product"
      ],
      "source": "cve-coordination@logitech.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve-coordination@logitech.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration."
    },
    {
      "lang": "es",
      "value": "El control inadecuado de la generación de código ('inyección de código') en Electron Fuses en Logitech Options Plus versión 1.60.496306 en macOS permite a los atacantes ejecutar código arbitrario a través de una configuración insegura de Electron Fuses."
    }
  ],
  "lastModified": "2026-06-17T08:22:12.950",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:logitech:logi_options\\+:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AB31CA5-5B26-4E90-BEB6-CDC73D0E7648",
              "versionEndExcluding": "1.70.551909",
              "versionStartIncluding": "1.60.496306"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve-coordination@logitech.com"
}