CVE-2024-4230

Quick assessment

Affected

Edgecross Consortium Edgecross Basic Software for Windows

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Edgecross Basic Software是Edgecross公司的一个在边缘计算领域中使用的软件平台，它提供了多种功能来支持数据的利用和处理。 Edgecross Basic Software ECP-BS1-W-D 1.00及之前版本存在安全漏洞，该漏洞源于不正确的外部控制文件名或路径，允许攻击者在系统上执行恶意程序，可能导致信息泄露、信息篡改或拒绝服务。

CVSS 7.8 · High EPSS 0.22% · P13 Updated Jan 25, 2025

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-4230

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

文件名或路径的外部可控制

Source: CVE Program / CVE List V5

Vulnerability Title

Edgecross Basic Software 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Edgecross Consortium	Edgecross Basic Software for Windows	versions 1.00 and later	-
Edgecross Consortium	Edgecross Basic Software for Developers	versions 1.00 and later	-