CVE-2024-1149: Improper validation of update packages

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-08 · updated 2026-06-17
Weakness: CWE-347

Description

Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.

Affected products

Snow Software Inventory Agent: before 6.7.2; from 6.14.0 before 6.14.5; 6.12.0 — fixed in 6.14.5, 6.7.2

How to fix

Upgrade to a fixed version: Snow Software Inventory Agent 6.14.5, 6.7.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1149 or the next vulnerability affects your stack