CVE-2024-51330
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in UltiMaker Cura versions 4.41, 5.8.1 and earlier allows a local attacker to execute arbitrary code via the Inter-process communication (IPC) mechanism between the Cura application and CuraEngine processes, localhost network stack, printing settings, and G-code processing and transmission components, as well as Ultimaker 3D Printers.
Risk Assessment
The risk involves a local attacker gaining control over the 3D printing process, potentially leading to printer damage, data theft, or production sabotage.
Recommendation
It is recommended to immediately update UltiMaker Cura to the latest available version and restrict local access to the system running the application.
Original NVD description (English source)
An issue in UltiMaker Cura v.4.41 and 5.8.1 and before allows a local attacker to execute arbitrary code via Inter-process communication (IPC) mechanism between Cura application and CuraEngine processes, localhost network stack, printing settings and G-code processing and transmission components, Ultimaker 3D Printers.