CVE-2024-5404
Critical
Description
An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.
SeverityCritical
CVSS9.8
Exploit probability—
Productmoneo appliance QVA200
PublishedJun 3, 2024
First seenJun 3, 2024
Weakness typeCWE-640CWE-640
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ifm moneo appliance QVA200 | v ≤ 1.13 | — |
| ifm moneo appliance QHA210 | v ≤ 1.13 | — |
| ifm moneo appliance QHA300 | v ≤ 1.13 | — |
| ifm moneo for Micosoft Windows | v ≤ 1.13 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.