CVE-2024-26291
Published: Jul 14, 2025
Modified: Jul 14, 2025
Description
An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allowing users to read arbitrary files. As the application runs with the highest privileges (root/NT_AUTHORITY SYSTEM) by default attackers are able to obtain sensitive information. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
| Vendor | Product | Versions |
|---|---|---|
Avid | Avid NEXIS E-series | affected 0 - < 2025.5.1 |
Avid | Avid NEXIS F-series | affected 0 - < 2025.5.1 |
Avid | Avid NEXIS PRO+ | affected 0 - < 2025.5.1 |
Avid | System Director Appliance (SDA+) | affected 0 - < 2025.5.1 |
Weaknesses (CWE)
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now