CVE-2024-23620

IBM Merge Healthcare eFilm Workstation SYSTEM Privilege Escalation

An improper privilege management vulnerability exists in IBM Merge Healthcare eFilm Workstation. A local, authenticated attacker can exploit this vulnerability to escalate privileges to SYSTEM.

Affected

IBM Merge Healthcare · eFilm Workstation

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 EXODUSINTEL

8.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 EXODUSINTEL

6.8 MEDIUMAV:L/AC:L/Au:S/C:C/I:C/A:C

EPSS

0.16% chance of exploitation in the next 30 days, 5th percentile

Published

2024-01-25

Updated

2024-11-13

Proof-of-concept exploits (1)

• daniteaxh853/cve_2024_236200★ · 2025-11-12

Security advisories

• https://blog.exodusintel.com/2024/01/25/ibm-merge-healthcare-efilm-workstation-system-pri…

References

• CVE Record
• NVD entry