Vulnerability in Absolute Security Secure Access
CVE-2024-40872
There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access and valid desktop user credentials can elevate their privilege to system level by passing invalid address data to the vulnerable component. This could be used to manipulate process tokens to elevate the privilege of a normal process to System. The scope is changed, the impact to system confidentiality and integrity is high, the impact to the availability of the effected component is none.
EPSS: 0.002 (5.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Absolute Security Secure Access — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2024-40872?
- CVE-2024-40872 is a high-severity vulnerability in Absolute Security Secure Access, classified under Untrusted Pointer Dereference. CVSS score: 8.4/10. Published 2024-07-25.
- How severe is CVE-2024-40872?
- High severity. CVSS v3 base score is 8.4 out of 10.
- Is CVE-2024-40872 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.