CVE-2024-12757
Published: 17 January 2025
Summary
CVE-2024-12757 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Cisa (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-12757 is a missing authentication vulnerability (CWE-306) in the Nedap Librix Ecoreader, where critical functions lack proper authentication controls. This flaw, published on 2025-01-17, could allow an unauthenticated attacker to potentially execute malicious code. The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), reflecting its high severity due to network accessibility, low attack complexity, and no prerequisite privileges or user interaction.
An unauthenticated attacker with network access to the affected Nedap Librix Ecoreader can exploit this vulnerability remotely. Exploitation requires low complexity and no user interaction, potentially leading to execution of malicious code with high confidentiality impact, low integrity impact, and low availability impact under an unchanged scope.
The CISA ICS Advisory ICSA-25-007-02, available at https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-02, provides guidance on mitigation for this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51092
Vulnerability details
Nedap Librix Ecoreader is missing authentication for critical functions that could allow an unauthenticated attacker to potentially execute malicious code.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on network-accessible critical functions directly enables remote exploitation of a public-facing application for malicious code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification and limitation of critical functions accessible without authentication, preventing unauthenticated exploitation of the Nedap Librix Ecoreader's vulnerable services.
Mandates identification and authentication of system services as a prerequisite for access, directly countering the missing authentication in critical Ecoreader functions.
Enforces approved access authorizations, ensuring mechanisms block unauthenticated access to critical functions that could lead to malicious code execution.