Medium severity · published Mar 12, 2024
CVE-2024-24964
Improper access control vulnerability exists in the resident process of SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
Improper access control vulnerability exists in the resident process of SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2. If this vulnerability is exploited, an arbitrary process may be executed with SYSTEM privilege by a user who can log in to the PC where the product's Windows client is installed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Skysea Client View · Skygroup
11.220.05p through 19.101.01a · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-24964
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-24964
Third Party Advisory
https://jvn.jp/en/jp/JVN54451757/
Vendor Advisory
https://www.skyseaclientview.net/news/240307_01/
More from Skysea Client View
9.8
CVE-2016-7836
SKYSEA Client View Improper Authentication Vulnerability
7.8
CVE-2026-39454
SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD
7.8
CVE-2024-41143
Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e
7.8
CVE-2024-41139
Incorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e
7.8
CVE-2024-21805
Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2