{"id":"CVE-2024-22078","state":"PUBLISHED","title":"An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Privilege escalation can occur via world writable files. The network configuration script ","description":"An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Privilege escalation can occur via world writable files. The network configuration script has weak filesystem permissions. This results in write access for all authenticated users and the possibility to escalate from user privileges to administrative privileges.","publishedAt":"2024-03-20T00:00:00.000Z","updatedAt":"2024-08-03T19:40:29.520Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://www.elspec-ltd.com/support/security-advisories/"],"weaknesses":["CWE-280"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/22xxx/CVE-2024-22078.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-22078","state":"PUBLISHED","datePublished":"2024-03-20T00:00:00.000Z","dateUpdated":"2024-08-03T19:40:29.520Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2024-01-05T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Privilege escalation can occur via world writable files. The network configuration script has weak filesystem permissions. This results in write access for all authenticated users and the possibility to escalate from user privileges to administrative privileges."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://www.elspec-ltd.com/support/security-advisories/"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"n/a"}]}],"providerMetadata":{"shortName":"mitre","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateUpdated":"2024-03-20T04:37:31.818Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.elspec-ltd.com/support/security-advisories/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T22:35:34.701Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"elspec","product":"g5_digital_fault_recorder","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.1.4.15","versionType":"custom"}],"cpes":["cpe:2.3:a:elspec:g5_digital_fault_recorder:*:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-08-03T19:39:19.023777Z","id":"CVE-2024-22078","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-280","type":"CWE","lang":"en","description":"CWE-280 Improper Handling of Insufficient Permissions or Privileges"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-03T19:40:29.520Z"}}]}}}