SL1 Affected by Unspecified Vulnerability
CVE-2024-9537

9.8CRITICAL

Key Information:

Vendor

Sciencelogic

Status
Sl1
Vendor
CVE Published:
18 October 2024

Badges

👾 Exploit Exists🟣 EPSS 33%🦅 CISA Reported📰 News Worthy

What is CVE-2024-9537?

The vulnerability tracked as CVE-2024-9537 affects ScienceLogic SL1, a widely used IT infrastructure monitoring and management platform, due to an unspecified third-party component packaged with the software. This vulnerability has been actively exploited in the wild and has a critical severity level. It could potentially lead to remote code execution. ScienceLogic has released patches and remediations for affected versions, and CISA has mandated that Federal Civilian Executive Branch agencies address this vulnerability by November 11, 2024. This addition underscores the urgent need for organizations to address this vulnerability promptly to mitigate potential security risks. The impact of this vulnerability extends beyond federal networks, and all organizations using ScienceLogic SL1 are advised to apply the necessary updates and follow the vendor's guidelines for remediation.

CISA has reported CVE-2024-9537

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-9537 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

SL1 0 < 12.1.3

SL1 0 < 12.2.3

SL1 0 < 12.3

News Articles

favicon imageThe Stack

Sciencelogic critical zero day remains unidentified despite in-the-wild exploitation

CISA warns of "unspecified vulnerability involving an unspecified third-party component."

favicon imageCyberSecurityNews

CISA Adds Sciencelogic SL1 Unspecified Vulnerability to KEV Catalog

CISA has recently added a critical security vulnerability affecting ScienceLogic SL1 to its Known Exploited Vulnerabilities (KEV).

favicon imageThe Cyber Express

CVE-2024-9537: Critical Flaw In ScienceLogic SL1

CISA's addition of CVE-2024-9537 to the KEV Catalog is a reminder of the evolving nature of cyber threats.

References

https://rackspace.service-now.com/system_status?id=detail...
https://twitter.com/ynezzor/status/1839931641172467907
https://www.theregister.com/2024/09/30/rackspace_zero_day...
media-coverage

EPSS Score

33% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by TheCyberThrone

  • Vulnerability published

  • Vulnerability Reserved

.