Exploitation Summary
CVE-2024-26291 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allowing users to read arbitrary files. As the application runs with the highest privileges (root/NT_AUTHORITY SYSTEM) by default attackers are able to obtain sensitive information. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
Nuclei Templates (1)
Avid NEXIS Agent - Arbitrary File Read
HIGHVERIFIEDby DhiyaneshDK
FOFA:
body="Avid Nexis"
References (2)
Core 2
Core References
Various Sources vendor-advisory
https://resources.avid.com/SupportFiles/attach/AvidNEXIS/AvidNEXIS_2025_5_1_ReadMe.pdf
Various Sources third-party-advisory
technical-description
https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_Avid_Nexus_Agent_Multiple_Vulnerabilities_en.html
Scores
CVSS v4
8.7
EPSS
0.0107
EPSS Percentile
60.4%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-285
Status
published
Products (4)
Avid/Avid NEXIS E-series
< 2025.5.1
Avid/Avid NEXIS F-series
< 2025.5.1
Avid/Avid NEXIS PRO+
< 2025.5.1
Avid/System Director Appliance (SDA+)
< 2025.5.1
Published
Jul 14, 2025
Tracked Since
Feb 18, 2026