CVE-2024-31202
📋 TL;DR
This vulnerability allows a local attacker to escalate privileges by exploiting incorrect permissions in the ThermoscanIP installation folder. Attackers can modify critical files to gain higher system privileges. Only systems with ThermoscanIP installed are affected.
💻 Affected Systems
- ThermoscanIP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative/root privileges, allowing complete control over the affected system.
Likely Case
Local privilege escalation to SYSTEM/root level, enabling installation of malware, data theft, or persistence mechanisms.
If Mitigated
Limited impact if proper access controls and least privilege principles are enforced on the installation folder.
🎯 Exploit Status
Exploitation requires local access and knowledge of the vulnerable folder location. No authentication bypass needed beyond initial local access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31202
Restart Required: Yes
Instructions:
1. Visit the vendor advisory URL
2. Download the latest patched version of ThermoscanIP
3. Uninstall the vulnerable version
4. Install the patched version
5. Restart the system
🔧 Temporary Workarounds
Restrict installation folder permissions
windowsModify permissions on the ThermoscanIP installation folder to prevent unauthorized write access
icacls "C:\Program Files\ThermoscanIP" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" /deny "Users:(OI)(CI)(W)"
🧯 If You Can't Patch
- Remove ThermoscanIP from critical systems
- Implement strict access controls and monitoring on the installation folder
🔍 How to Verify
Check if Vulnerable:
Check if ThermoscanIP is installed and verify folder permissions allow write access to non-administrative usersCheck Version:
Check ThermoscanIP about dialog or installation directory for version informationVerify Fix Applied:
Verify ThermoscanIP version is updated to patched version and installation folder has proper restrictive permissions📡 Detection & Monitoring
Log Indicators:
- Unauthorized file modifications in ThermoscanIP installation folder
- Privilege escalation attempts
- Suspicious process creation from ThermoscanIP directory
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
EventID=4663 AND ObjectName LIKE '%ThermoscanIP%' AND Accesses LIKE '%WRITE%'