CVE-2024-9537ScienceLogic SL1 unspecified vulnerability
Updated under an hour ago ()
Does this affect you?
It affects ScienceLogic SL1. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Oct 21, 2024; federal agencies had to remediate by Nov 11, 2024. Treat that date as your deadline.
Do this next
Free account, 1 product
ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The vulnerability is addressed in SL1 versions 12.1.3+, 12.2.3+, and 12.3+. Remediations have been made available for all SL1 versions back to version lines 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Added to CISA KEV Oct 21, 2024; federal remediation due Nov 11, 2024Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 3.83% (percentile 90)
- Assigned by
- cisa-cg
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
ScienceLogic SL1 sciencelogic:sl1 (from the name) | before 12.1.3; before 12.2.3; before 12.3; before 10.1.x; before 10.2.x; before 11.1.x; before 11.2.x; before 11.3.x | CNA record |
sciencelogic sl1 sciencelogic:sl1 | before 12.1.3; before 12.2.3; before 12.3; before 10.1.x; before 10.2.x; before 11.1.x; before 11.2.x; before 11.3.x | CISA ADP |
sciencelogic sl1 sciencelogic:sl1 | from 10.1.0 before 12.1.3; from 12.2.0 before 12.2.3 | NVD |
References
- https://rackspace.service-now.com/system_status?id=detailed_status&service=4dafca5a87f41610568b206f8bbb35a6third-party-advisory
- https://twitter.com/ynezzor/status/1839931641172467907third-party-advisory
- https://www.theregister.com/2024/09/30/rackspace_zero_day_attack/media-coverage, press/media-coverage
- https://arcticwolf.com/resources/blog/rackspace-breach-linked-to-zero-day-vulnerability-sciencelogic-sl1s-third-party-utility/third-party-advisory, press/media-coverage
- https://www.bleepingcomputer.com/news/security/rackspace-monitoring-data-stolen-in-sciencelogic-zero-day-attack/media-coverage, press/media-coverage
- https://support.sciencelogic.com/s/article/15465vendor-advisory, permissions-required
- https://support.sciencelogic.com/s/article/15527vendor-advisory, permissions-required
- https://community.sciencelogic.com/blog/latest-kb-articles-and-known-issues-blog-board/week-of-september-30-2024---latest-kb-articles-and-known-issues-part-1-of-2/1690release-notes, vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9537government-resource, third-party-advisory, us-government-resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9537us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.