Vulnerabilites related to BlackBerry - SecuSUITE
CVE-2024-51722 (GCVE-0-2024-51722)
Vulnerability from cvelistv5
Published
2024-11-12 18:08
Modified
2024-11-13 15:31
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-250 - - Execution with Unnecessary Privileges
Summary
A local privilege escalation vulnerability in the SecuSUITE Server (System Configuration) of SecuSUITE versions 5.0.420 and earlier could allow a successful attacker that had gained control of code running under one of the system accounts listed in the configuration file to potentially issue privileged script commands.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BlackBerry | SecuSUITE |
Version: 5.0.420 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:blackberry:secusuite:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secusuite",
"vendor": "blackberry",
"versions": [
{
"status": "affected",
"version": "5.0.420"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-51722",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-13T15:30:34.416241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T15:31:37.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"SecuSUITE Server (System Configuration)"
],
"product": "SecuSUITE",
"vendor": "BlackBerry",
"versions": [
{
"status": "affected",
"version": "5.0.420"
}
]
}
],
"datePublic": "2024-11-12T18:04:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003elocal privilege escalation\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e vulnerability in the \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSecuSUITE\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e Server \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e(System Configuration) \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eof \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSecuSUITE\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e versions 5.0.420 and earlier could allow a\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e successful\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e attacker \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethat had gained control of code running under one of the system accounts listed in the configuration file \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eto potentially \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eissue privileged script commands\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e"
}
],
"value": "A local privilege escalation vulnerability in the SecuSUITE Server (System Configuration) of SecuSUITE versions 5.0.420 and earlier could allow a successful attacker that had gained control of code running under one of the system accounts listed in the configuration file to potentially issue privileged script commands."
}
],
"impacts": [
{
"capecId": "CAPEC-69",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-69 Target Programs with Elevated Privileges"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 - Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T18:47:36.960Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/140220"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2024-51722",
"datePublished": "2024-11-12T18:08:12.921Z",
"dateReserved": "2024-10-30T17:19:06.485Z",
"dateUpdated": "2024-11-13T15:31:37.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-51720 (GCVE-0-2024-51720)
Vulnerability from cvelistv5
Published
2024-11-12 18:01
Modified
2025-09-11 20:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim’s account and telephone number.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BlackBerry | SecuSUITE |
Version: 5.0.420 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-51720",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-12T21:38:30.257463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T21:38:39.845Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"SecuSUITE Secure Client Authentication"
],
"product": "SecuSUITE",
"vendor": "BlackBerry",
"versions": [
{
"status": "affected",
"version": "5.0.420"
}
]
}
],
"datePublic": "2024-11-12T17:35:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003en insufficient entropy vul\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003enerability \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ein the \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSecuSUITE\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSecure Client Authentication (SCA) Server \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eof \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSecuSUITE\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e version\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003es\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e 5.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e0.420 and earlie\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003er could allow an \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eattacker to potentially \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eenroll an attacker-controlled device to the victim\u2019s account and telephone number.\u003c/span\u003e\u0026nbsp;"
}
],
"value": "An insufficient entropy vulnerability in the SecuSUITE Secure Client Authentication (SCA) Server of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially enroll an attacker-controlled device to the victim\u2019s account and telephone number."
}
],
"impacts": [
{
"capecId": "CAPEC-49",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-49 Password Brute Forcing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-334",
"description": "CWE-334 Small Space of Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-11T20:22:23.080Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/140220"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2024-51720",
"datePublished": "2024-11-12T18:01:49.411Z",
"dateReserved": "2024-10-30T17:19:06.485Z",
"dateUpdated": "2025-09-11T20:22:23.080Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-51721 (GCVE-0-2024-51721)
Vulnerability from cvelistv5
Published
2024-11-12 18:05
Modified
2024-11-12 21:34
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Summary
A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially inject script commands or other executable content into the server that would run with root privilege.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BlackBerry | SecuSUITE |
Version: 5.0.420 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:blackberry:secusuite:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "secusuite",
"vendor": "blackberry",
"versions": [
{
"status": "affected",
"version": "5.0.420"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-51721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-12T21:32:19.174330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T21:34:23.825Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"SecuSUITE Server Web Administration Portal"
],
"product": "SecuSUITE",
"vendor": "BlackBerry",
"versions": [
{
"status": "affected",
"version": "5.0.420"
}
]
}
],
"datePublic": "2024-11-12T18:03:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecode injection\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e vulnerability in the \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSecuSUITE\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServer Web Administration Portal \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eof \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSecuSUITE\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e versions 5.0.420 and earlier could allow an attacker to potentially \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003einject script commands or other executable content into the server that would run with root privilege.\u003c/span\u003e"
}
],
"value": "A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially inject script commands or other executable content into the server that would run with root privilege."
}
],
"impacts": [
{
"capecId": "CAPEC-132",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-132 Symlink Attack"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-12T18:43:15.094Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/140220"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2024-51721",
"datePublished": "2024-11-12T18:05:32.232Z",
"dateReserved": "2024-10-30T17:19:06.485Z",
"dateUpdated": "2024-11-12T21:34:23.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}