CVE-2024-9497
CVSS 3.1 Score 8.6 of 10 (high)
Details
Published Jan 24, 2025
CWE ID 427
Summary
CVE-2024-9497 is a newly disclosed vulnerability affecting the USBXpress 4 SDK installer. This issue arises due to an uncontrolled search path within the installer, which results in DLL hijacking. An attacker could exploit this vulnerability to achieve privilege escalation, ultimately leading to arbitrary code execution upon executing the affected installer. This vulnerability poses a significant risk and demands prompt attention for remediation.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.