CVE-2024-9537criticalunder attack

CVE-2024-9537: critical vulnerability in ScienceLogic SL1

ScienceLogic SL1 unspecified vulnerability

Published · Updated

Follow this CVE+ Monitor SL1

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.3epss 3.8%
from disclosure to weapon
Published on NVDOct 18
CISA KEV+3d
Action required by CISAfederal deadline: 2024-11-11

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

ScienceLogic SL1 monitoring platform contains a critical vulnerability in one of its third-party components that could allow attackers to compromise the system. The exact nature of the flaw is not disclosed, but it affects multiple versions and requires immediate patching.

Technical detail

An unspecified third-party component integrated into ScienceLogic SL1 contains a critical vulnerability (CVSS 9.3) with unspecified attack vectors and impact. Affected versions include 10.1.x through 12.2.x; patches are available in SL1 12.1.3+, 12.2.3+, and 12.3+, with backports provided for earlier version lines.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The vulnerability is addressed in SL1 versions 12.1.3+, 12.2.3+, and 12.3+. Remediations have been made available for all SL1 versions back to version lines 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Red
Affected products
ScienceLogic · SL1
Related CVEs — ScienceLogic SL1

In the same product, most dangerous first.

CVE-2025-58780HIGHCVE-2025-58780EPSS 0.2%