PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-6618 Ocean Data Systems CVE debrief

A path traversal vulnerability in Ocean Data Systems Dream Report 2023 allows local attackers to achieve remote code execution via malicious DLL injection. The flaw, published August 13, 2024, carries a CVSS 3.1 score of 7.8 (HIGH) and requires local access with low privileges but no user interaction. Affected versions include Dream Report 2023 up to 23.0.17795.1010 and AVEVA Reports for Operations 2023 at version 23.0.17795.1010. Ocean Data Systems has released Dream Report 2023 R2 (version 23.3.18952.0523) as a vendor fix, while AVEVA directs users to upgrade to Reports for Operations 2023 R2 or later and apply security bulletin AVEVA-2024-006.

Vendor
Ocean Data Systems
Product
Dream Report 2023
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-08-13
Original CVE updated
2024-08-13
Advisory published
2024-08-13
Advisory updated
2024-08-13

Who should care

Organizations running Ocean Data Systems Dream Report 2023 or AVEVA Reports for Operations 2023 in industrial environments, particularly manufacturing, energy, and critical infrastructure sectors where Dream Report is commonly deployed for operational reporting and data visualization.

Technical summary

The vulnerability exists in Dream Report 2023's handling of file paths, where insufficient validation allows traversal outside intended directories. An attacker with local access can leverage this to inject and execute a malicious dynamic-link library, achieving remote code execution with the privileges of the Dream Report process. The attack requires low privileges and no user interaction, making it exploitable by any local user account. The CVSS 3.1 score of 7.8 reflects high impacts across confidentiality, integrity, and availability despite the local attack vector.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Ocean Data Systems Dream Report 2023 to version 23.3.18952.0523 (2023 R2) or later
  • For AVEVA Reports for Operations 2023 deployments, upgrade to 2023 R2 or later and apply security bulletin AVEVA-2024-006
  • Review CISA ICS recommended practices for defense-in-depth strategies
  • Implement principle of least privilege for local user accounts accessing Dream Report systems
  • Monitor for unauthorized DLL loading attempts in Dream Report application directories

Evidence notes

CISA CSAF advisory ICSA-24-226-08 documents the path traversal vulnerability leading to DLL injection-based RCE. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms local attack vector with high impact on confidentiality, integrity, and availability.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-6618 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-6618

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-6618 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-6618

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-226-08.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-08

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.