CVE-2024-42448: Code Injection
From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs access to a VSPC management agent machine and the management agent must already be authorized on the VSPC server. No user interaction is required.
Can this be exploited remotely?
Yes. The CVSS vector identifies network-based exploitation with low attack complexity. Exploitation can result in remote code execution on the VSPC server machine.
What is the potential impact on the VSPC server?
Successful exploitation can provide high impact to confidentiality, integrity, and availability on the VSPC server. The vulnerability also has scope changed in its CVSS vector, indicating the impact extends beyond the initially affected management-agent security authority.