CVE-2024-3507: Privilege escalation vulnerability in Lunar

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-08 · updated 2026-06-17
Weakness: CWE-269

Description

Improper privilege management vulnerability in Lunar software that affects versions 6.0.2 through 6.6.0. This vulnerability allows an attacker to perform a secondary process injection into the Lunar application and abuse those rights to access sensitive user information.

Affected products

Lunar: from 6.0.2 before 6.6.0 — fixed in 6.6.0

How to fix

Upgrade to a fixed version: Lunar 6.6.0. Check the vendor advisory for mitigations.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-vulnerability-lunar
https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-vulnerability-lunar

Get alerted when CVE-2024-3507 or the next vulnerability affects your stack