CVE-2024-6913 is a high severity (CVSS 8.8) flaw in PerkinElmer ProcessPlus on Windows. The application runs with more privilege than it needs, and the advisory says that lets an attacker with database access spawn a remote shell. ProcessPlus 2.0.0 is reported as the fixed release.
What's affected
The NVD record lists ProcessPlus through 1.11.6507.0, with Windows as the platform. CyberDanube's advisory agrees on the version range.
The advisory describes the cause as the application using the SQL Server administrative account, named sa, to connect to its own database. With that account, the database feature that runs operating system commands can be used. The researchers present this as the third piece of a chain: a shared credential in CVE-2024-6912 gets the attacker to the database, and the excess privilege here turns that into control of the host.
The vendor's fix statement, relayed in the CyberDanube timeline, is version 2.0.0, released on 11 July 2024. The NVD record carries no fixed version, so check with the vendor before you close the item.
The weakness is CWE-250, execution with unnecessary privileges. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Note the low privileges required, unlike its sibling, which needs none. That one point is why this scores 8.8 and the credential flaw scores 9.8. I found no conflicting severity from another source.
How to check if you're exposed
- Confirm the ProcessPlus version on the host. At or below 1.11.6507.0 is affected.
- Ask your database administrator which login the application uses. If it is sa, the condition in the advisory is present.
- Check whether the SQL Server port is reachable from outside the host.
- Check SQL Server configuration to see whether the command execution feature is enabled. Leaving it off is a sensible baseline, though the advisory does not list it as the vendor's fix.
What to do now
- Upgrade to ProcessPlus 2.0.0 or later after vendor confirmation.
- Restrict network access to the host, as the advisory suggests.
- Change the default database credentials in the configuration file and in the database.
- If you manage the database yourself, move the application to a least privilege login that only has rights to its own database. Test this on a copy first, because the application may expect rights it should not have.
- Review Windows event logs and SQL Server logs for unexpected process creation on the host.
Why it matters
Least privilege limits the damage when something else goes wrong. Here the credential problem would have been a data exposure problem. The excess privilege turns it into a full compromise of a Windows machine, which in a lab or plant network may sit next to instruments and other equipment.
That pattern is common. A flaw rarely does harm alone, and the CVSS score for each piece understates the chain. A scanner that lists the three CVEs on one host is more useful than three separate tickets.
CISA does not list this CVE as known exploited, and no source here reports exploitation in the wild.
Quick check
Why is this 8.8 when the sibling credential flaw is 9.8?
The vector for this CVE requires low privileges, while CVE-2024-6912 requires none. Everything else in the two vectors matches.
Sources
Last reviewed: 19 October 2026.
