CVE-2024-5509 is a remote code execution vulnerability affecting Luxion KeyShot, KeyShot Network Rendering, and KeyShot Viewer, stemming from an uncontrolled search path element during BIP file parsing. An attacker can exploit this by crafting a malicious BIP file that, when opened by a user, causes the application to load a malicious library from an unsecured location. This allows for arbitrary code execution in the context of the current process. The vulnerability has a CVSS score of 7.8 (High), indicating a significant risk. It requires user interaction (e.g., opening a malicious file) and local access to the system, but has low attack complexity. Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, suggesting low public awareness of this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2024.1CPE matchmatch criteria | cpe:2.3:a:luxion:keyshot:*:*:*:*:*:*:*:* | ||
< 2024.1CPE matchmatch criteria | cpe:2.3:a:luxion:keyshot_network_rendering:*:*:*:*:*:*:*:* | ||
<= 2024.1CPE matchmatch criteria | cpe:2.3:a:luxion:keyshot_viewer:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.