CVE-2024-12757

CVE-2024-12757 is a missing authentication vulnerability (CWE-306) in the Nedap Librix Ecoreader, where critical functions lack proper authentication controls. This flaw, published on 2025-01-17, could allow an unauthenticated attacker to potentially execute malicious code. The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), reflecting its high severity due to network accessibility, low attack complexity, and no prerequisite privileges or user interaction.

An unauthenticated attacker with network access to the affected Nedap Librix Ecoreader can exploit this vulnerability remotely. Exploitation requires low complexity and no user interaction, potentially leading to execution of malicious code with high confidentiality impact, low integrity impact, and low availability impact under an unchanged scope.

The CISA ICS Advisory ICSA-25-007-02, available at https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-02, provides guidance on mitigation for this vulnerability.