Incorrect default permissions in Cradlepoint NetCloud Exchange
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The NetCloud Exchange client for Windows, version 1.110.50, contains an insecure file and folder permissions vulnerability. A normal (non-admin) user could exploit the weakness in file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control permissions exist on the ‘Everyone’ group (i.e. any user who has local access to the operating system regardless of their privileges).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cradlepoint | NetCloud Exchange Client | 1.110.50 | — | No fix listed | CNA |
- NetCloud Exchange Client VendorCradlepoint Affected 1.110.50 Fixed in — No fix listed CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cradlepoint:netcloud_exhange_client:*:*:*:*:*:*:*:* | — | — | Cradlepoint |
- cpe:2.3:a:cradlepoint:netcloud_exhange_client:*:*:*:*:*:*:*:* Versions — — ·Cradlepoint
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-11969
- 2026-10-03 Alias added: GHSA-56h4-rrgp-r6px
References
More Cradlepoint vulnerabilities
- TI-2022-02847 Cradlepoint IBR600 Command Injection CVSS 3.1HIGH 7.6
- TI-2021-15401 Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted… CVSS 3.1HIGH 7.5
Sources
- CVE-2024-11969 · CVE Program
- CVE-2024-11969 · NVD
- FIRST EPSS
- GHSA-56h4-rrgp-r6px · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences