Vulnerability · Published Apr 2, 2024 · Assigned by ProgressSoftware
CVE-2024-2389Flowmon Unauthenticated Command Injection Vulnerability
Critical 10.0
In plain English
A critical-severity OS command injection in Flowmon from Progress Software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 93.0% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.
Official description
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | Flowmon | 11.X – before 11.1.1412.X – before 12.3.5 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H