CVE-2024-5404

An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.

Score

CVSS 3.1 9.8 Critical

Status

Deferred - info@cert.vde.com

Published

2024-06-03

Last modified

2024-08-01

Weaknesses

CWE-640

Affected products

• Moneo Appliance Qha210 (Ifm)
• Moneo Appliance Qha300 (Ifm)
• Moneo Appliance Qva200 (Ifm)
• Moneo For Micosoft Windows (Ifm)
• Moneo For Microsoft Windows (Ifm)
• Moneo Qha210 (Ifm)
• Moneo Qha300 (Ifm)
• Moneo Qva200 (Ifm)

References

• https://cert.vde.com/en/advisories/VDE-2024-028