CVE-2024-22106

Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges, execute arbitrary code, or cause a Denial of Service (DoS).

Published: 2024-07-02 Last update: 2024-11-21 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2024-22106 is rated Low Risk (35.3/100): CVSS High severity, with low exploitation likelihood (EPSS 0.05%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2024-22106

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-11-18 0.04% 0.05% +0.01%
2 2025-08-18 0.10% 0.04% -0.05%
3 2025-06-22 — 0.10% —

Full EPSS history (6 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2024-22106

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.8 3.1 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 1.8 5.9 [email protected]
8.8 3.1 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 2.0 6.0 134c704f-9b21-4f2e-91b3-4a467353bcc0

Weakness enumeration for CVE-2024-22106

Affected software / configurations for CVE-2024-22106

Vendor Product Version Raw CPE
jungo windriver < 12.5.1 cpe:2.3:a:jungo:windriver:*:*:*:*:*:*:*:*
mitsubishielectric cpu_module_logging_configuration_tool — cpe:2.3:a:mitsubishielectric:cpu_module_logging_configuration_tool:*:*:*:*:*:*:*:*
mitsubishielectric cw_configurator — cpe:2.3:a:mitsubishielectric:cw_configurator:*:*:*:*:*:*:*:*
mitsubishielectric data_transfer — cpe:2.3:a:mitsubishielectric:data_transfer:*:*:*:*:*:*:*:*
mitsubishielectric data_transfer_classic — cpe:2.3:a:mitsubishielectric:data_transfer_classic:*:*:*:*:*:*:*:*
mitsubishielectric ezsocket — cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:*
mitsubishielectric fr_configurator_sw3 — cpe:2.3:a:mitsubishielectric:fr_configurator_sw3:*:*:*:*:*:*:*:*
mitsubishielectric fr_configurator2 — cpe:2.3:a:mitsubishielectric:fr_configurator2:*:*:*:*:*:*:*:*
mitsubishielectric genesis64 — cpe:2.3:a:mitsubishielectric:genesis64:*:*:*:*:*:*:*:*
mitsubishielectric gt_got1000 — cpe:2.3:a:mitsubishielectric:gt_got1000:*:*:*:*:*:*:*:*
mitsubishielectric gt_got2000 — cpe:2.3:a:mitsubishielectric:gt_got2000:*:*:*:*:*:*:*:*
mitsubishielectric gt_softgot1000 — cpe:2.3:a:mitsubishielectric:gt_softgot1000:*:*:*:*:*:*:*:*
mitsubishielectric gt_softgot2000 — cpe:2.3:a:mitsubishielectric:gt_softgot2000:*:*:*:*:*:*:*:*
mitsubishielectric gx_developer — cpe:2.3:a:mitsubishielectric:gx_developer:*:*:*:*:*:*:*:*
mitsubishielectric gx_logviewer — cpe:2.3:a:mitsubishielectric:gx_logviewer:*:*:*:*:*:*:*:*
mitsubishielectric gx_works2 — cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:*
mitsubishielectric gx_works3 — cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:*
mitsubishielectric iq_works — cpe:2.3:a:mitsubishielectric:iq_works:*:*:*:*:*:*:*:*
mitsubishielectric mi_configurator — cpe:2.3:a:mitsubishielectric:mi_configurator:*:*:*:*:*:*:*:*
mitsubishielectric mr_configurator — cpe:2.3:a:mitsubishielectric:mr_configurator:*:*:*:*:*:*:*:*
mitsubishielectric mr_configurator2 — cpe:2.3:a:mitsubishielectric:mr_configurator2:*:*:*:*:*:*:*:*
mitsubishielectric mx_component — cpe:2.3:a:mitsubishielectric:mx_component:*:*:*:*:*:*:*:*
mitsubishielectric mx_opc_server_da\/ua — cpe:2.3:a:mitsubishielectric:mx_opc_server_da\/ua:*:*:*:*:*:*:*:*
mitsubishielectric numerical_control_device_communication — cpe:2.3:a:mitsubishielectric:numerical_control_device_communication:*:*:*:*:*:*:*:*
mitsubishielectric px_developer\/monitor_tool — cpe:2.3:a:mitsubishielectric:px_developer\/monitor_tool:*:*:*:*:*:*:*:*
mitsubishielectric rt_toolbox3 — cpe:2.3:a:mitsubishielectric:rt_toolbox3:*:*:*:*:*:*:*:*
mitsubishielectric rt_visualbox — cpe:2.3:a:mitsubishielectric:rt_visualbox:*:*:*:*:*:*:*:*
mitsubishielectric mrzjw3-mc2-utl_firmware — cpe:2.3:o:mitsubishielectric:mrzjw3-mc2-utl_firmware:*:*:*:*:*:*:*:*
mitsubishielectric sw0dnc-mneth-b_firmware — cpe:2.3:o:mitsubishielectric:sw0dnc-mneth-b_firmware:*:*:*:*:*:*:*:*
mitsubishielectric sw1dnc-ccbd2-b_firmware — cpe:2.3:o:mitsubishielectric:sw1dnc-ccbd2-b_firmware:*:*:*:*:*:*:*:*
mitsubishielectric sw1dnc-ccief-j_firmware — cpe:2.3:o:mitsubishielectric:sw1dnc-ccief-j_firmware:*:*:*:*:*:*:*:*
mitsubishielectric sw1dnc-ccief-b_firmware — cpe:2.3:o:mitsubishielectric:sw1dnc-ccief-b_firmware:*:*:*:*:*:*:*:*
mitsubishielectric sw1dnc-mnetg-b_firmware — cpe:2.3:o:mitsubishielectric:sw1dnc-mnetg-b_firmware:*:*:*:*:*:*:*:*
mitsubishielectric sw1dnc-qsccf-b_firmware — cpe:2.3:o:mitsubishielectric:sw1dnc-qsccf-b_firmware:*:*:*:*:*:*:*:*
mitsubishielectric sw1dnd-emsdk-b_firmware — cpe:2.3:o:mitsubishielectric:sw1dnd-emsdk-b_firmware:*:*:*:*:*:*:*:*

References for CVE-2024-22106

cvelogic Threat Intelligence