CVE-2024-46917

Aug. 29, 2025, 6:15 p.m.

8.1
High

Description

Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR01 does not validate file attributes or the contents of /root during integrity validation. This allows code execution, recovery of TPM Disk Encryption keys, decryption of the Windows system partition, and full control of the Windows OS, e.g., through ~/.profile changes.

Product(s) Impacted

Vendor Product Versions
Diebold Nixdorf
  • Vynamic Security Suite
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-353
Missing Support for Integrity Check
The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a diebold_nixdorf vynamic_security_suite / / / / / / / /

References

https://github.com/emptynebuli
https://www.atredis.com/blog/2025/8/26/24nrgne4dqbwjxyip7txn8ep6zj057
https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/

Tags

cve@mitre.org
CWE-353
2025-08-29
CVE-2024-46917

CVSS Score

8.1 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

    View Vector String

Timeline

Published: Aug. 29, 2025, 4:15 p.m.
Last Modified: Aug. 29, 2025, 6:15 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.