« Volver al listado

CVE-2024-5404

Estado: AplazadaCrítica (9.8)—

An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Moneo — Moneo ApplianceAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-5404",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-5404",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-03T14:52:37.095029Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "ifm",
          "product": "moneo appliance QVA200",
          "versions": [
            {
              "status": "affected",
              "version": "0.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.13"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ifm",
          "product": "moneo appliance QHA210",
          "versions": [
            {
              "status": "affected",
              "version": "0.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.13"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ifm",
          "product": "moneo appliance QHA300",
          "versions": [
            {
              "status": "affected",
              "version": "0.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.13"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ifm",
          "product": "moneo for Micosoft Windows",
          "versions": [
            {
              "status": "affected",
              "version": "0.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.13"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:h:ifm:moneo_qha210:-:*:*:*:*:*:*:*"
          ],
          "vendor": "ifm",
          "product": "moneo_qha210",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.13"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:ifm:moneo_qha300:1.1.3:*:*:*:*:*:*:*"
          ],
          "vendor": "ifm",
          "product": "moneo_qha300",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.13"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:ifm:moneo_qva200:1.13:*:*:*:*:*:*:*"
          ],
          "vendor": "ifm",
          "product": "moneo_qva200",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.13"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:ifm:moneo_for_microsoft_windows:1.13:*:*:*:*:*:*:*"
          ],
          "vendor": "ifm",
          "product": "moneo_for_microsoft_windows",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.13"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-03T09:15:10.193",
  "references": [
    {
      "url": "https://cert.vde.com/en/advisories/VDE-2024-028",
      "source": "info@cert.vde.com"
    },
    {
      "url": "https://cert.vde.com/en/advisories/VDE-2024-028",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-640"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.\n"
    },
    {
      "lang": "es",
      "value": "Un atacante remoto no autenticado puede cambiar la contraseña de administrador en un dispositivo moneo debido a un mecanismo de recuperación de contraseña débil."
    }
  ],
  "lastModified": "2026-06-17T08:15:52.803",
  "sourceIdentifier": "info@cert.vde.com"
}