CVE-2024-7872
Published: 06 March 2025
Description
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
Security Summary
CVE-2024-7872 is an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) in ExtremePACS Extreme XDS, which allows attackers to retrieve embedded sensitive data. The issue affects Extreme XDS versions prior to 3933. It has a CVSS v3.1 base score of 7.6 (High), with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, indicating high confidentiality impact alongside low integrity and availability impacts.
Attackers on an adjacent network (AV:A) can exploit this vulnerability with low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N) required. Successful exploitation enables retrieval of highly sensitive data embedded in sent transmissions (C:H), with potential for minor integrity modifications (I:L) and service disruptions (A:L), all within the unchanged scope (S:U).
Mitigation involves upgrading to Extreme XDS version 3933 or later. Additional details are available in the advisory at https://www.usom.gov.tr/bildirim/tr-25-0057.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability allows retrieval of sensitive data embedded in network transmissions on an adjacent network (AV:A), directly facilitating network sniffing to capture cleartext/sensitive information.