CVE-2024-9950
Published: 02 January 2025
Summary
CVE-2024-9950 is a high-severity Creation of Temporary File in Directory with Insecure Permissions (CWE-379) vulnerability in Forescout Secureconnector. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 17.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-4 (Information in Shared System Resources).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Prevents unauthorized modification of compliance scripts in insecure temporary directories, which are shared system resources.
Enforces logical access controls, including file system permissions, to block low-privilege local attackers from modifying compliance scripts via the insecure temporary directory.
Monitors software and information integrity to identify unauthorized modifications to compliance scripts exploited through the insecure temporary directory.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Insecure temp directory enables local script modification for attacker-controlled code execution (T1059) and facilitates privilege escalation via the resulting high-impact compromise (T1068).
NVD Description
A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify compliance scripts due to insecure temporary directory.
Deeper analysisAI
CVE-2024-9950 is a vulnerability in Forescout SecureConnector version 11.3.07.0109 on Windows that allows an unauthenticated user to modify compliance scripts due to an insecure temporary directory. Published on January 2, 2025, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-379 (Creation of Temporary File in Directory with Insecure Permissions).
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. By leveraging the insecure temporary directory, the attacker can modify compliance scripts, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized code execution or disruption of compliance enforcement.
For mitigation details, refer to the Forescout support page at https://support.forescout.com/.
Details
- CWE(s)