ZDI-CAN-25094: ZDI-25-076: NoMachine Incorrect Permission Assignment Local Privilege Escalation Vulnerability

Published Feb 3, 2025

Updated

This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.7. The following CVEs are assigned: CVE-2024-9632.

Affected Software

1 affected component

NoMachine NoMachine

Event History

Feb 3, 2025

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25094?

ZDI-CAN-25094 has been assigned a CVSS rating of 6.7, indicating a medium severity vulnerability.

How do I fix ZDI-CAN-25094?

To fix ZDI-CAN-25094, apply the latest security updates provided by NoMachine for your affected installation.

Who is affected by ZDI-CAN-25094?

ZDI-CAN-25094 affects installations of the NoMachine software.

What type of vulnerability is ZDI-CAN-25094?

ZDI-CAN-25094 is a privilege escalation vulnerability that allows local attackers to gain higher privileges.

What must an attacker do to exploit ZDI-CAN-25094?

An attacker must first have the ability to execute low-privileged code on the target system to exploit ZDI-CAN-25094.