CVE-2024-9537
CVE-2024-9537 is a critical-severity vulnerability in Sciencelogic Sl1 with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2024-10-21).
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- CVSS v4: 9.3
- EPSS exploit prediction: 4% (89th percentile)
- Actively exploited: Yes — listed in CISA KEV (added 2024-10-21)
- EU (EUVD) id: EUVD-2024-49996
- EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2024-10-21)
- Affected product: Sciencelogic Sl1
- Published:
- Last modified:
Description
ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The vulnerability is addressed in SL1 versions 12.1.3+, 12.2.3+, and 12.3+. Remediations have been made available for all SL1 versions back to version lines 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x.
Frequently asked questions
- What is CVE-2024-9537?
- ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The vulnerability is addressed in SL1 versions 12.1.3+, 12.2.3+, and 12.3+. Remediations have been made available for all SL1 versions back to version lines 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x.
- How severe is CVE-2024-9537?
- CVE-2024-9537 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2024-9537 being actively exploited?
- Yes. CVE-2024-9537 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2024-10-21, which means active exploitation has been confirmed. It should be prioritised for remediation.
- What products are affected by CVE-2024-9537?
- CVE-2024-9537 affects Sciencelogic Sl1. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-9537?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
- Does CVE-2024-9537 have an EU (EUVD) identifier?
- Yes. CVE-2024-9537 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-49996. It is also flagged as exploited in the EUVD (since 2024-10-21).
- When was CVE-2024-9537 published?
- CVE-2024-9537 was published on 2024-10-18 and last updated on 2026-06-17.
References
- https://arcticwolf.com/resources/blog/rackspace-breach-linked-to-zero-day-vulnerability-sciencelogic-sl1s-third-party-utility/
- https://community.sciencelogic.com/blog/latest-kb-articles-and-known-issues-blog-board/week-of-september-30-2024---latest-kb-articles-and-known-issues-part-1-of-2/1690
- https://rackspace.service-now.com/system_status?id=detailed_status&service=4dafca5a87f41610568b206f8bbb35a6
- https://support.sciencelogic.com/s/article/15465
- https://support.sciencelogic.com/s/article/15527
- https://twitter.com/ynezzor/status/1839931641172467907
- https://www.bleepingcomputer.com/news/security/rackspace-monitoring-data-stolen-in-sciencelogic-zero-day-attack/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9537
- https://www.theregister.com/2024/09/30/rackspace_zero_day_attack/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9537
Affected products (1)
- cpe:2.3:a:sciencelogic:sl1:*:*:*:*:*:*:*:*
More vulnerabilities in Sciencelogic Sl1
- CVE-2022-48604 — High (CVSS 8.8): A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized…
- CVE-2022-48603 — High (CVSS 8.8): A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes…
- CVE-2022-48602 — High (CVSS 8.8): A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes…
- CVE-2022-48601 — High (CVSS 8.8): A SQL injection vulnerability exists in the “network print report” feature of the ScienceLogic SL1 that takes…
- CVE-2022-48600 — High (CVSS 8.8): A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized…
- CVE-2022-48599 — High (CVSS 8.8): A SQL injection vulnerability exists in the “reporter events type” feature of the ScienceLogic SL1 that takes…