NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

CVE-2024-7253

What is CVE-2024-7253?

An uncontrolled search path element vulnerability exists in the NoMachine software that can be exploited for local privilege escalation. This flaw is specifically found within the nxnode.exe component, where the software loads a library from an insecure location. By executing low-privileged code on the affected system, an attacker can leverage this flaw to gain elevated privileges and execute arbitrary code with SYSTEM-level access. This presents significant security risks for installations of NoMachine, necessitating immediate attention to mitigate potential exploitation.

References