Vulnerability · Published Jun 3, 2024 · Assigned by CERTVDE
CVE-2024-5404ifm: moneo prone to weak password recovery mechanism
Critical 9.8
In plain English
A critical-severity security flaw in moneo appliance QHA210 from ifm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 53.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ifm | moneo appliance QVA200 | 0.0 – through 1.13 |
| ifm | moneo appliance QHA210 | 0.0 – through 1.13 |
| ifm | moneo appliance QHA300 | 0.0 – through 1.13 |
| ifm | moneo for Micosoft Windows | 0.0 – through 1.13 |
Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H