TI-2024-00234 Aliases CVE-2024-0259 GHSA-4q5q-v9v4-9c33

Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04

LOW 34CWE-276Published 2024-03-28 · Updated 2024-08-01

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to gain elevated privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00284 21st percentileScored 2026-11-07

Fix Fixed Robot Schedule Enterprise Agent (Fortra): 3.04

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Fortra	Robot Schedule Enterprise Agent	2.0 to before 3.04	3.04	Patch available	CNA

Robot Schedule Enterprise Agent VendorFortra Affected 2.0 to before 3.04 Fixed in 3.04 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:fortra:robot_schedule:::::enterprise:::*	before 3.04	Vulnerable	Fortra
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:fortra:robot_schedule:*:*:*:*:enterprise:*:*:* Versions before 3.04 Vulnerable ·Fortra
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA Robot Schedule Enterprise Agent (Fortra) Fixed in 3.04

Timeline

2026-10-02 Threatist record created from CVE-2024-0259
2026-10-03 Alias added: GHSA-4q5q-v9v4-9c33

References

Advisory 1

https://www.fortra.com/security/advisory/fi-2024-005

Other 1

https://hstechdocs.helpsystems.com/releasenotes/Content/_ProductPages/Robot/RobotScheduleEnterprise.htm

TI-2024-07661 Sensitive information in log files in Fortra Robot Schedule Enterprise CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences