Vulnerabilities

ScienceLogic SL1 (formerly EM7), an enterprise IT infrastructure monitoring platform, is affected by a critical vulnerability (CVSS 4.0: 9.3) in an unspecified third-party component packaged with the product; technical details have not been publicly disclosed. The severity vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates it can be triggered remotely over the network by an unauthenticated attacker with no user interaction or special conditions. High impacts on confidentiality, integrity, and availability suggest full compromise of the SL1 appliance, giving attackers a foothold in the monitored environment. Any organization running SL1 versions prior to 12.1.3, 12.2.3, or 12.3 — including older 10.1.x through 11.3.x lines — is affected. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2024-10-21 following reports of active zero-day exploitation; no public proof-of-concept is known, and whether ransomware groups are leveraging it is unconfirmed.

Do: Upgrade to SL1 12.1.3+, 12.2.3+, or 12.3+, or apply ScienceLogic's remediations for the 10.1.x–11.3.x lines; per CISA's KEV required action, apply vendor mitigations promptly or discontinue use if mitigations are unavailable. Inventory your SL1 deployments (including appliances managed on behalf of MSP customers), restrict internet exposure of SL1 management interfaces pending patching, and monitor for exploitation activity; ransomware association is not yet confirmed.

A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.