nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-26293 CVE-2024-26293
HIGH
Unauthenticated Path Traversal affecting Avid NEXIS
Record summary
CVE-2024-26293 has a selected CVSS score of 8.7 (high).
Description
The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 14, 2025 · Source: CVE List
Affected products and versions
4| Product | Source | Version range | Status |
|---|---|---|---|
Avid NEXIS E-seriesBrowse Avid / Avid NEXIS E-seriesDefault status: unaffected | CVE List | Before 2025.5.1 | affected |
Avid NEXIS F-seriesBrowse Avid / Avid NEXIS F-seriesDefault status: unaffected | CVE List | Before 2025.5.1 | affected |
Avid NEXIS PRO+Browse Avid / Avid NEXIS PRO+Default status: unaffected | CVE List | Before 2025.5.1 | affected |
System Director Appliance (SDA+)Browse Avid / System Director Appliance (SDA+)Default status: unaffected | CVE List | Before 2025.5.1 | affected |
References
4raeph123.github.ioThird-party advisoryTechnical description
https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_Avid_Nexus_Agent_Multiple_Vulnerabilities_en.html resources.avid.comVendor advisory
https://resources.avid.com/SupportFiles/attach/AvidNEXIS/AvidNEXIS_2025_5_1_ReadMe.pdf genivia.comThird-party advisory
https://www.genivia.com/changelog.html