CVE-2024-9325

Intelbras InControl incontrol-service-watchdog.exe unquoted search path

State: Published
Severity: 8.5 High
Published: Sep 29, 2024
Updated: Nov 4, 2024
Reserved: Sep 28, 2024

Description

A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\Program Files (x86)\Intelbras\Incontrol Cliente\incontrol_webcam\incontrol-service-watchdog.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. Upgrading to version 2.21.58 is able to address this issue. It is recommended to upgrade the affected component. The vendor was informed early on 2024-08-05 about this issue. The release of a fixed version 2.21.58 was announced for the end of August 2024 but then was postponed until 2024-09-20.

Scores

CVSS	Score	Vector	Source
4.0	8.5 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulDB
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	VulDB
3.0	7.8 High	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	VulDB
2.0	6.8 Medium	AV:L/AC:L/Au:S/C:C/I:C/A:C	VulDB

Weaknesses

CWE-428 Unquoted Search Path
CWE-426 Untrusted Search Path

Affected Products

Product	Versions
InControlIntelbras	2.21.0Affected 2.21.1Affected 2.21.2Affected 2.21.3Affected 2.21.4Affected 2.21.5Affected 2.21.6Affected 2.21.7Affected 2.21.8Affected 2.21.9Affected 2.21.10Affected 2.21.11Affected 2.21.12Affected 2.21.13Affected 2.21.14Affected 2.21.15Affected 2.21.16Affected 2.21.17Affected 2.21.18Affected 2.21.19Affected 2.21.20Affected 2.21.21Affected 2.21.22Affected 2.21.23Affected 2.21.24Affected and 32 more versions

Product

Versions

InControlIntelbras

2.21.0Affected
2.21.1Affected
2.21.2Affected
2.21.3Affected
2.21.4Affected
2.21.5Affected
2.21.6Affected
2.21.7Affected
2.21.8Affected
2.21.9Affected
2.21.10Affected
2.21.11Affected
2.21.12Affected
2.21.13Affected
2.21.14Affected
2.21.15Affected
2.21.16Affected
2.21.17Affected
2.21.18Affected
2.21.19Affected
2.21.20Affected
2.21.21Affected
2.21.22Affected
2.21.23Affected
2.21.24Affected
and 32 more versions

References

VDB-278829 | Intelbras InControl incontrol-service-watchdog.exe unquoted search pathvdb-entrytechnical-description
VDB-278829 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #385397 | Intelbras InControl 2.21.56 Unquoted Search Paththird-party-advisory
https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdfrelated
https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INCONTROL-WEB-2.21.58-233dfd1ac1e2ca3eabb71c854005c78b.exepatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.