CVE-2024-25858: 
Foxit PDF Reader vulnerability analysis and mitigation

A security vulnerability identified as CVE-2024-25858 affects Foxit PDF Reader and PDF Editor versions before 2024.1. The vulnerability relates to potential code execution via JavaScript due to an unoptimized prompt message for users to review parameters of commands (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.4 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, as assessed by CISA-ADP. The vulnerability stems from improper handling of command parameter review prompts, specifically related to JavaScript execution capabilities (NVD).

If exploited, this vulnerability could allow attackers to execute code through JavaScript functionality, potentially compromising the integrity and security of the affected systems. The high CVSS score indicates significant potential impact on confidentiality, integrity, and availability of the system (NVD).

The vulnerability requires local access with no privileges and no user interaction, as indicated by the CVSS vector string. The low attack complexity suggests that exploitation could be relatively straightforward for an attacker with the necessary access (NVD).

Users are advised to update to Foxit PDF Reader 2024.1 or Foxit PDF Editor 2024.1 or later versions to address this vulnerability. The fix has been implemented in these versions to properly optimize the prompt message for command parameter review (Foxit Security).