CVE-2024-11969 — Incorrect default permissions in Cradlepoint NetCloud Exchange

Description (CNA)

The NetCloud Exchange client for Windows, version 1.110.50, contains an insecure file and folder permissions vulnerability. A normal (non-admin) user could exploit the weakness in file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control permissions exist on the ‘Everyone’ group (i.e. any user who has local access to the operating system regardless of their privileges).

Affected (CNA)

Vendor / product	Versions
Cradlepoint / NetCloud Exchange Client	affected 1.110.50

CWE

CWE-276

References

https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-default-permissions-cradlepoint-netcloud-exchange

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.