« Volver al listado

CVE-2024-4230

Estado: AplazadaAlta (7.8)—

External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L, UI:R indica ejecución en cliente (archivo preparado); CWE-73 (path traversal) permite ejecutar código arbitrario. Impactos: ejecución (descripción explícita), manipulación de datos (tampering), DoS (negación de servicio).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageLimit Software InstallationFilter Network Traffic

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Edgecross — Basic Software FOR DevelopersAIEdgecross — Basic Software FOR WindowsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-4230",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-4230",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-19T16:27:48.756311Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "affectedData": [
        {
          "vendor": "Edgecross Consortium",
          "product": "Edgecross Basic Software for Windows",
          "versions": [
            {
              "status": "affected",
              "version": "versions 1.00 and later"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Edgecross Consortium",
          "product": "Edgecross Basic Software for Developers",
          "versions": [
            {
              "status": "affected",
              "version": "versions 1.00 and later"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-19T08:17:30.470",
  "references": [
    {
      "url": "https://jvn.jp/vu/JVNVU92857077/index.html",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://www.edgecross.org/client_info/EDGECROSS/view/userweb/ext/en/data-download/pdf/ECD-TE10-0003-01-EN.pdf",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de control externo de nombre de archivo o ruta en Edgecross Basic Software para Windows versiones 1.00 y posteriores y Edgecross Basic Software para desarrolladores versiones 1.00 y posteriores permite que un atacante local malintencionado ejecute un código malicioso arbitrario, lo que resulta en la divulgación, manipulación y eliminación de información, o una condición de denegación de servicio (DoS)."
    }
  ],
  "lastModified": "2026-06-17T08:01:22.460",
  "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
}