« Volver al listado

CVE-2024-52061

Estado: AnalizadaAlta (8.3)—

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording Service, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Buffer overflow en servicio remoto de red (AV:N) sin autenticación (PR:N) permite ejecución de código arbitrario. CWE-120/787 confirman desbordamiento clásico que potencialmente escala privilegios.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability Scanning

Tecnologías afectadas (1)

RTI — Connext Professional

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52061",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52061",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-23T20:02:30.481034Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "3f572a00-62e2-4423-959a-7ea25eff1638",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "3f572a00-62e2-4423-959a-7ea25eff1638",
      "affectedData": [
        {
          "vendor": "RTI",
          "modules": [
            "Core Libraries",
            "Queuing Service",
            "Recording Service",
            "Routing Service"
          ],
          "product": "Connext Professional",
          "versions": [
            {
              "status": "affected",
              "version": "7.4.0",
              "lessThan": "7.5.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "lessThan": "7.3.0.5",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.1.0",
              "lessThan": "6.1.2.21",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.0.1.40",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "5.0.0",
              "lessThan": "5.3.1.45",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-13T11:15:08.457",
  "references": [
    {
      "url": "https://www.rti.com/vulnerabilities/#cve-2024-52061",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "3f572a00-62e2-4423-959a-7ea25eff1638"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "3f572a00-62e2-4423-959a-7ea25eff1638",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording Service, Routing Service) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.1.40, from 5.0.0 before 5.3.1.45."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de copia de búfer sin comprobar el tamaño de la entrada ('desbordamiento de búfer clásico') en RTI Connext Professional (librerías principales, servicio de cola, servicio de grabación, servicio de enrutamiento) permite desbordamiento de variables y etiquetas. Este problema afecta a Connext Professional: desde la versión 7.4.0 hasta la 7.5.0, desde la versión 7.0.0 hasta la 7.3.0.5, desde la versión 6.1.0 hasta la 6.1.2.21, desde la versión 6.0.0 hasta la 6.0.1.40, desde la versión 5.0.0 hasta la 5.3.1.45."
    }
  ],
  "lastModified": "2026-06-17T08:06:53.493",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4662FA7C-56A5-4491-A359-DF62550A9231",
              "versionEndExcluding": "5.3.1.45",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8FE0AD3-A12C-4A7F-BE66-725B7B941176",
              "versionEndExcluding": "6.0.1.40",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F6B4325-F208-482A-B0FF-56FD3DEFB35A",
              "versionEndExcluding": "6.1.2.21",
              "versionStartIncluding": "6.1.0"
            },
            {
              "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73826C13-CDA4-453A-AE9A-B94AF1A9F63E",
              "versionEndExcluding": "7.3.0.5",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A042A71-7A6A-41BB-A5B2-C07C5206D2E3",
              "versionEndExcluding": "7.5.0",
              "versionStartIncluding": "7.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "3f572a00-62e2-4423-959a-7ea25eff1638"
}