CVE-2024-46464 is a vulnerability identified in PRIMX ZED Enterprise versions up to 2024.3. The issue arises from improper handling of technical files stored in local folders accessible by common users. This misconfiguration or design flaw allows an attacker with local access to manipulate these files, potentially causing the host system to become unavailable (denial of service) or enabling the execution of arbitrary programs with elevated privileges. The vulnerability is classified under CWE-276 (Incorrect Default Permissions), indicating that the problem stems from insecure file or folder permissions that allow unauthorized modification. The CVSS v3.1 score of 7.8 reflects a high severity, with an attack vector limited to local access (AV:L), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), and a scope change (S:C). The impact primarily affects confidentiality (high) and availability (high), while integrity impact is not noted. Although no known exploits have been reported in the wild and no patches are currently available, the vulnerability poses a significant risk due to the potential for privilege escalation and system disruption. The lack of patches necessitates immediate attention to mitigate risk through configuration and access control measures. This vulnerability highlights the importance of securing local file permissions and restricting access to sensitive technical files within enterprise environments.

The vulnerability can have severe consequences for organizations running PRIMX ZED Enterprise. Successful exploitation can lead to denial of service, making critical systems unavailable and disrupting business operations. More critically, it allows privilege escalation, enabling attackers to execute arbitrary code with elevated rights, potentially leading to full system compromise. This can result in unauthorized access to sensitive data, lateral movement within networks, and further exploitation of enterprise infrastructure. The high confidentiality impact suggests that sensitive information could be exposed or manipulated. The requirement for local access limits remote exploitation but does not eliminate risk, especially in environments where multiple users share systems or where attackers can gain initial foothold through other means. The absence of known exploits in the wild provides a window for proactive defense, but the lack of patches increases urgency for mitigation. Organizations in sectors relying on PRIMX ZED Enterprise for critical operations may face operational, reputational, and compliance risks if this vulnerability is exploited.

Given the absence of official patches, organizations should implement immediate compensating controls. First, restrict access to local folders containing technical files by tightening file system permissions to allow only trusted administrative users. Conduct thorough audits of file and folder permissions to identify and remediate insecure configurations. Employ endpoint protection solutions that monitor and block unauthorized file modifications and suspicious process executions. Limit the number of users with local access to systems running PRIMX ZED Enterprise and enforce the principle of least privilege. Use application whitelisting to prevent execution of unauthorized programs. Monitor system logs for unusual activity indicative of exploitation attempts. Consider isolating critical systems or running them in hardened environments with minimal user interaction. Stay alert for vendor updates or patches and apply them promptly once available. Additionally, educate system administrators about the risks of improper file permissions and the importance of secure configuration management.