Skip to content
OpenAdvisories
High VDE-2024-021 2 CVEs

WAGO: Vulnerability in WAGO Navigator

Published May 21, 2024 · Updated May 21, 2024

Vendor: WAGO Product: Navigator

Summary

The WAGO Navigator versions 1.0.1 and 1.0 are vulnerable due to the use of the WiX toolset version 3.11.2.

Details

Impact
The vulnerabilities affect the previous versions installer itself, leading to a potential privilege escalation during installation of WAGO Navigator. Already installed versions are not affected as long as the installer is not executed again.

Remediation
A fix is available with the WAGO Navigator 1.0.2 and is accessible through the WAGO download center.

Vulnerabilities 2

  • High 8.3
    CVE-2024-24810

    WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

    WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX in…

    wixtoolset issues wix NuGet
  • High 7.3
    CVE-2024-29187

    WiX based installers are vulnerable to binary hijack when run as SYSTEM

    WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard …

    wixtoolset issues wix WixToolset.Sdk NuGet

Revision history

  1. #1

    Initial revision.

References