Auth bypass in Avid Nexis E-Series
CVE-2024-26291
An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allowing users to read arbitrary files. As the application runs with the highest privileges (root/NT_AUTHORITY SYSTEM) by default attackers are able to obtain sensitive information. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
EPSS: 0.011 (61.8th percentile) — read the EPSS interpretation.
Affected products
- Avid Nexis E-series — versions 0
- Avid Nexis F-series — versions 0
- Avid Nexis Pro+ — versions 0
- Avid System Director Appliance (Sda+) — versions 0
Weakness classification (CWE)
References
- a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (vendor-advisory)
- a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (technical-description, third-party-advisory)