7.5
High
CVE-2024-2097 An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM…
Description
An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MACH SCM Server 4.0 | 4.0 → 4.38.3 | No fix stated |
| MACH SCM Tools 1.0 | 1.0 → 1.8 | No fix stated |
| modular_advanced_control_for_hvdc 4.0 | 4.0 → 4.38 | No fix stated |