{"id":"CVE-2024-12903","state":"PUBLISHED","title":"Incorrect default permissions in Biamp Evoko Home","description":"Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control permissions exist on the ‘Everyone’ group (i.e. any user who has local access to the operating system regardless of their privileges).","publishedAt":"2024-12-23T12:41:12.704Z","updatedAt":"2024-12-24T01:59:35.383Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"INCIBE"},"assigner":"INCIBE","products":["Biamp Evoko Home Service"],"affected":[{"vendor":"Biamp","product":"Evoko Home Service","defaultStatus":"unaffected","versions":[{"version":"2.4.2","status":"affected","lessThanOrEqual":"2.7.4.","versionType":"custom"}],"platforms":["Windows"]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-default-permissions-biamp-evoko-home"],"weaknesses":["CWE-276"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/12xxx/CVE-2024-12903.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-12903","state":"PUBLISHED","datePublished":"2024-12-23T12:41:12.704Z","dateUpdated":"2024-12-24T01:59:35.383Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2024-12-23T11:33:35.547Z"},"containers":{"cna":{"title":"Incorrect default permissions in Biamp Evoko Home","descriptions":[{"lang":"en","value":"Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control permissions exist on the ‘Everyone’ group (i.e. any user who has local access to the operating system regardless of their privileges)."}],"affected":[{"vendor":"Biamp","product":"Evoko Home Service","defaultStatus":"unaffected","versions":[{"version":"2.4.2","status":"affected","lessThanOrEqual":"2.7.4.","versionType":"custom"}],"platforms":["Windows"]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-default-permissions-biamp-evoko-home"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-276","description":"CWE-276 Incorrect Default Permissions","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2024-12-23T12:41:12.704Z"},"credits":[{"lang":"en","type":"finder","value":"Alexander Huaman Jaimes"}],"datePublic":"2024-12-23T11:00:00.000Z","source":{"discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Temporary mitigation measures until the new version is released is to use Ubuntu instead of Windows."}],"value":"Temporary mitigation measures until the new version is released is to use Ubuntu instead of Windows."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-24T01:59:08.850622Z","id":"CVE-2024-12903","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-24T01:59:35.383Z"}}]}}}