Authenticated File Deletion Vulnerability in Avid NEXIS Products
CVE-2024-26292

7.1HIGH

Key Information:

Vendor

Avid

Status
Avid Nexis E-series
Avid Nexis F-series
Avid Nexis Pro+
System Director Appliance (sda+)
Vendor
CVE Published:
14 July 2025

What is CVE-2024-26292?

An authenticated Arbitrary File Deletion vulnerability in Avid NEXIS products allows attackers with valid credentials to delete critical files. This issue affects multiple models including Avid NEXIS E-series, F-series, PRO+, and System Director Appliance, all prior to version 2025.5.1. Exploitation of this vulnerability could lead to significant data loss and service disruption for organizations relying on these systems.

Affected Version(s)

Avid NEXIS E-series Linux 0 < 2025.5.1

Avid NEXIS F-series Linux 0 < 2025.5.1

Avid NEXIS PRO+ Linux 0 < 2025.5.1

References

https://resources.avid.com/SupportFiles/attach/AvidNEXIS/...
vendor-advisory
https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_...
third-party-advisorytechnical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

DriveByte
CERT-Bund
.