CVE-2024-13186

High

Published: 08 January 2025

Published

08 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0011 29.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13186 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Vivo (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, ranked at the 29.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Directly addresses permitting URL loading without identification or authentication in the MinigameCenter module, preventing unauthorized access and information leakage.

AC-3 Access Enforcement good match

prevent

Enforces approved access control policies to block unauthenticated requests to load URLs, mitigating the core vulnerability.

SC-14 Public Access Protections partial match

prevent

Provides protections for public access to limit unauthorized disclosure of information via unrestricted URL loading in the module.

NVD Description

The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.

Deeper analysisAI

CVE-2024-13186 is a vulnerability in the MinigameCenter module stemming from insufficient restrictions on loading URLs, which can result in information leakage. This issue is tied to software from Vivo, as detailed in their security advisory. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified under CWE-306 (Missing Authentication for Critical Function). It was published on 2025-01-08.

The attack scenario involves unauthenticated remote attackers who can exploit the flaw over the network with low attack complexity and no user interaction required. Exploitation enables high-impact confidentiality violations, allowing attackers to access leaked information without compromising system integrity or availability.

Vivo has published a security advisory addressing this vulnerability, available at https://www.vivo.com/en/support/security-advisory-detail?id=16, which security practitioners should consult for details on patches and mitigation steps.