CVE-2024-38292
Published: 27 February 2025
Summary
CVE-2024-38292 is a critical-severity Path Traversal (CWE-22) vulnerability in Extremenetworks Xiq-Se. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-38292 is a path traversal vulnerability (CWE-22) affecting Extreme Networks XIQ-SE versions before 24.2.11. The issue stems from a missing access control check, which enables attackers to traverse directories and potentially escalate privileges. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker with network access can exploit this vulnerability with low attack complexity and no user interaction. Exploitation allows traversal of intended file paths, leading to privilege escalation and potential unauthorized access to sensitive data or system controls.
Extreme Networks security advisory SA-2024-104 addresses this issue, recommending an upgrade to XIQ-SE version 24.2.11 or later as the primary mitigation. Additional details are available at https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2024-104-xiq-se-path-traversal-privilege-escalation-cve-2024/ba-p/116362.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53958
Vulnerability details
In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege escalation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal with missing auth enables remote exploitation of public-facing app (T1190) and direct privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly addressing the missing access control check that enables path traversal and privilege escalation in XIQ-SE.
Validates information inputs such as file paths to block traversal sequences exploited by unauthenticated remote attackers.
Limits privileges to minimize the impact of escalation resulting from successful path traversal exploitation.