CVE Disclosure: [CVE-2024-10930]

Public Disclosure of CVE-2024-10930

Date: [12-02-2025]

Summary

A vulnerability was identified in Carrier product E20-BLK416X.EXE version 4.16, which could allow local privilege escalation. This issue has been assigned the identifier [CVE-2024-10930] .The vendor will release an advisory with further details and remediation steps.

Affected Products

• Vendor: Carrier
• Product: E20-BLK416X.EXE
• Version: 4.16
• Updated Version: 4.2

Vulnerability Description

Carrier was informed about the issue in Block Load software that could potentially allow execution of arbitrary code when running Block Load installer (E20-BLK416X.EXE). A successful attempt would require the local user having downloaded or otherwise placed, a malicious binary application in the same directory as installer binary and then running the installer.

Impact

If successful, the attackers code would execute with the elevated privileges of the application.

Remediation

It is strongly recommended that users of the affected products take the following actions:

1. Update to the fixed version as mentioned in the vendor's advisory: The new version (4.2) of Block Load for Windows.

Credit

This vulnerability was discovered by Sahil Shah, Shaurya & Shuvro and we thank the vendor, Carrier, for their co-operation in releasing a patch.

Timeline

• Date of Discovery: [19 Septmber 2024]
• Vendor Notification: [11 November 2024]
• Patch Release: [22 November 2024]
• Vendor Acknowledgment: [In Process]
• Public Disclosure: [In Progress]

References

• Link to CVE entry
• Link to Vendor Advisory: Released Soon

Contact

If you have any questions or need more information, feel free to reach out at [[email protected]] & Linkedin