CVE-2024-8885

Published: Oct 2, 2024Modified: Jun 17, 2026Deferred

8.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 2.0 / Impact: 6.0

Source: security-alert@sophos.com (Secondary)

Description

A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writing of arbitrary files.

Related CWEs

CWE-1104

Use of Unmaintained Third Party Components

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (1)

https://www.sophos.com/en-us/security-advisories/sophos-sa-20241002-cde-lpe

Source: security-alert@sophos.com

Timeline

No history available yet.