CVE-2024-0770 is a medium severity (CVSS 4.4) incorrect default permissions issue in the desktop installer of European Chemicals Agency IUCLID 7.10.3 on Windows, reachable only locally. The record says the vendor did not respond to the disclosure, so no fixed version is confirmed. Check the vendor for updates.
What's affected
European Chemicals Agency IUCLID 7.10.3 on Windows. The affected item is the file iuclid6.exe in the Desktop Installer component. The attack needs local access.
The record states the vendor was contacted early and did not respond. No fixed version appears in it, and I could not confirm one, so the vendor's download page and advisories should be checked directly.
The record classifies the weakness as CWE-276 (incorrect default permissions). NVD scores it 4.4 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
The sources differ on severity. The description, taken from VulDB, calls the issue critical. NVD's CVSS 3.1 score is 4.4 (Medium). The local attack requirement and the high privileges in the vector are the main reasons the number is lower. Both ratings are published, so judge it against how many shared Windows machines run this installer.
How to check if you're exposed
Find the installed product version through the product's own About dialog or the installed programs list on the machine. Then compare it with the fixed version named above.
The weakness here sits in the installer, so also check where old installer packages are stored, such as shared drives, build servers and software distribution points. An outdated installer on a share can be reused long after the product itself is updated.
What to do now
- List the Windows machines where IUCLID 7.10.3 desktop is installed.
- Check the vendor's site for a newer release, and read its release notes for installer or permission changes.
- Review the permissions on the installation folder and on iuclid6.exe. Standard users should not be able to write to them. Fix any write access you find.
- Limit who has local logon on machines that run the desktop installer, and remove leftover installer copies from shared locations.
Why it matters
Incorrect default permissions (CWE-276) means files or folders ship with access broader than they need. On a shared Windows machine, a low privilege user who can modify a program that others run, or an installer that runs elevated, may be able to run their own code with more rights.
The local only requirement makes this a lateral movement or insider concern, not an internet exposure. It is worth a quick permissions audit, not an emergency.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Why list a medium issue with no fix?
Because the mitigation is something you control. Correcting folder permissions removes the local weakness the record describes even without a vendor patch.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
