CVE-2024-48394
Published: 05 February 2025
Summary
CVE-2024-48394 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Ndd (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-48394 is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability, mapped to CWE-367, in the driver of the NDD Print solution. It affects version 5.24.3 and earlier of the software. The issue enables an unprivileged user to exploit the flaw and gain SYSTEM-level access on the device. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-02-05.
A local attacker with low privileges, such as an unprivileged user on the system, can exploit this vulnerability. Exploitation requires low complexity and no user interaction. Successful attacks allow the attacker to achieve high impacts across confidentiality, integrity, and availability, culminating in full SYSTEM-level privilege escalation on the affected device.
Mitigation details are available in the vendor advisory at https://helpcenter-nddprint.ndd.tech/pt/seguranca-e-compliance/Current/dezembro-2024#0.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43258
Vulnerability details
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unprivileged user to exploit this flaw and gain SYSTEM-level access on the device. The vulnerability affects version 5.24.3 and…
more
before of the software.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
TOCTOU race condition in local driver directly enables local privilege escalation from unprivileged user to SYSTEM.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the TOCTOU vulnerability by requiring timely identification, reporting, and correction through vendor patches for affected NDD Print driver versions 5.24.3 and earlier.
Enforces least privilege on processes including drivers, limiting the scope and impact of privilege escalation from unprivileged user to SYSTEM-level access.
Mandates robust enforcement of access authorizations, addressing the flawed time-of-check to time-of-use logic in the print driver that enables unauthorized SYSTEM access.