CVE-2024-6911 is a high severity (CVSS 7.5) file disclosure flaw in PerkinElmer ProcessPlus, a measurement software package sold under the Perten name. An unauthenticated network user can read files from the Windows host. ProcessPlus 2.0.0 is reported as the fixed release, so upgrade and limit network access.
What's affected
The NVD record says ProcessPlus through 1.11.6507.0 is affected. The researcher advisory from CyberDanube lists the same boundary, written as 1.11.6507.0 and earlier.
For the fix, the sources need to be read together. The CyberDanube timeline says the vendor first indicated the local file inclusion would be fixed in version 1.16. A later vendor contact, dated 15 July 2024, said all three issues from the disclosure were fixed in version 2.0.0, released on 11 July 2024. The NVD record carries no fixed version. Treat 2.0.0 as the target, and ask PerkinElmer or Perten support to confirm it for your installation.
The weakness class is CWE-552, files or directories accessible to external parties. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which means network reachable, no privileges, and a confidentiality impact only. There is no integrity or availability impact from this one flaw on its own. I found no second severity figure for this CVE. CyberDanube rates the disclosure as a whole "High", which agrees with the 7.5 here.
This CVE was disclosed together with CVE-2024-6912 and CVE-2024-6913. The advisory says the three combine, so patching one and ignoring the others leaves risk behind.
How to check if you're exposed
ProcessPlus is a Windows application, so there is no package manager query. Use these steps instead.
- Open Programs and Features on the Windows host and read the ProcessPlus version. Anything at or below 1.11.6507.0 is in scope.
- Find out whether the web interface is reachable beyond the machine itself. Check the Windows firewall rules and any network ACLs in front of the host.
- Look at your asset inventory for other Perten or PerkinElmer measurement hosts that may run the same software.
- Review the web server access logs for unusual download requests to the log download feature. The advisory identifies the log download function as the affected area, so that is where to look first.
What to do now
- Upgrade ProcessPlus to 2.0.0 or later, after confirming the release with the vendor.
- Until the upgrade is done, restrict network access to the host. The advisory lists this as its workaround.
- Assume the configuration files on an exposed host may have been read. Rotate any secrets stored in files on that machine, including database credentials.
- Handle CVE-2024-6912 and CVE-2024-6913 in the same change window.
- Record the host and its version in your inventory so the next scan catches a regression.
Why it matters
The record describes the flaw as a local file inclusion that exposes files on the Windows system without authentication. The web interface accepts a file name and returns a file, and the checks around that path are not enough to keep the request inside the intended log folder.
The impact is larger than a single file read. System wide files and configuration can include application settings and connection details. In the disclosure, reading configuration is the first step toward the database access described in the sibling CVEs. CISA does not list this CVE in the Known Exploited Vulnerabilities catalogue, and nothing in the sources says it was exploited in the wild.
Quick check
Does this need a login to reach?
No. The CVSS vector sets privileges required to none, and the advisory calls the file inclusion unauthenticated.
Is a fixed version confirmed in the NVD record?
No. The fixed version, 2.0.0, comes from the vendor statement quoted in the CyberDanube advisory timeline. Confirm it with the vendor.
Sources
Last reviewed: 19 October 2026.
