Cyber Resilience

CVE-2024-13173

Medium

Published: 08 January 2025

Published
08 January 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 6.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0023 46.4th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13173 is a medium-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Vivo (inferred from references). Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2024-13173 is a vulnerability in the health module stemming from insufficient restrictions on loading URLs, which can result in information leakage. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-306 (Missing Authentication for Critical Function). The issue was published on 2025-01-08 and affects components within Vivo software, as detailed in the vendor's security advisory.

A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables high-impact confidentiality violations, allowing the attacker to access sensitive information through unrestricted URL loading in the health module, while integrity and availability remain unaffected.

Vivo has published a security advisory providing details on the vulnerability at https://www.vivo.com/en/support/security-advisory-detail?id=14, which security practitioners should consult for recommended mitigations and patches.

EU & UK References

Vulnerability details

The health module has insufficient restrictions on loading URLs, which may lead to some information leakage.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct remote unauthenticated exploitation of a public-facing health module via unrestricted URL loading for high-impact information disclosure.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-21515Shared CWE-306
CVE-2025-57432Shared CWE-306
CVE-2026-27446Shared CWE-306
CVE-2026-21446Shared CWE-306
CVE-2021-47891Shared CWE-306
CVE-2025-41715Shared CWE-306
CVE-2026-24790Shared CWE-306
CVE-2025-21524Shared CWE-306
CVE-2025-53072Shared CWE-306
CVE-2025-40771Shared CWE-306

Affected Assets

Vivo
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly limits user actions performable without identification or authentication, preventing information leakage from unrestricted URL loading in the unauthenticated health module.

prevent

Mandates verification of authorization at public interfaces like the health module prior to allowing access, mitigating unauthenticated exploitation leading to confidentiality violations.

prevent

Enforces approved access authorizations for system resources, blocking remote unauthenticated attackers from exploiting the health module's insufficient URL loading restrictions.

References