Overall Information
- Original Released Date: February 17, 2025
- Update Date: February 17, 2025
- CVE Identifier(s) (If appliable): CVE-2024-47935
- CVSS Version 3.1
- Severity: Medium
- Score: 6.7
- Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS Version 4.0
- Severity: Medium
- Score: 5.4
- Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
TXOne Networks has released new StellarProtect (Legacy Mode), StellarEnforce, and Safe Lock that resolve the vulnerability in the product.
Description
Improper Validation of Integrity Check Value vulnerability in TXOne Networks StellarProtect (Legacy Mode), StellarEnforce, and Safe Lock allows an attacker to escalate their privileges in the victim’s device. The attacker needs to hijack the DLL file in advance.
This issue affects StellarProtect (Legacy Mode): before 3.2; StellarEnforce: before 3.2; Safe Lock: from 3.0.0 before 3.1.1076.
*Note: StellarProtect (Legacy Mode) is the new name for StellarEnforce, they are the same product.
Please note that the attacker needs to hijack the DLL file in advance to achieve privilege escalation.
Affected Version(s)
| Product | Affected Version(s) |
|---|---|
| StellarProtect (Legacy Mode) | Before 3.2 |
| StellarEnforce | Before 3.2 |
| Safe Lock | From 3.0.0 before 3.1.1076 |
*Note: StellarProtect (Legacy Mode) is the new name for StellarEnforce, they are the same product.
Solution
TXOne Networks has released the following solution to address the issue
| Product | Updated Version(s) | Note | Availability |
|---|---|---|---|
| StellarProtect (Legacy Mode) | V3.2.1169 | Readme | Now available, please visit MyTXOne Portal to download updated version. |
| StellarEnforce | Fixed in StellarProtect (Legacy Mode) version V3.2.1169 | N/A | Now available, please visit MyTXOne Portal to download updated version. |
| Safe Lock | V3.1.1076 | Update package in Japanese ; Update package in English | Now available, please visit the link on the left to download updated version. |
These are the minimum recommended version(s) of the patches and/or builds required to address the issue. TXOne Networks highly encourages customers to obtain the latest version of the product if there is a newer one available than the one listed in this bulletin.
Acknowledgement
TXOne Networks would like to thank the following individual for responsibly disclosing these issues and working with TXOne Networks to help protect our customers:
• Sahil Shah, Shaurya, and Ramya Shah of National Forensic Sciences University
External Reference(s)
If you encounter any problems related to this vulnerability, please contact security@txone.com