CVE-2024-2389
Published: 02 April 2024
Summary
CVE-2024-2389 is a critical-severity OS Command Injection (CWE-78) vulnerability in Progress Flowmon. Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-2389 is an operating system command injection vulnerability, tracked under CWE-78, that affects Flowmon versions prior to 11.1.14 and 12.3.5. The flaw resides in the management interface and carries a maximum CVSS 3.1 score of 10.0 due to its network-accessible, unauthenticated, and scope-changing nature.
An unauthenticated attacker can exploit the issue remotely over the network to obtain initial access through the management interface and then execute arbitrary operating system commands, resulting in complete compromise of confidentiality, integrity, and availability on the affected system.
Vendor advisories published by Kemp Technologies direct customers to upgrade to the fixed releases 11.1.14 or 12.3.5; the same guidance is referenced on the Flowmon site. The associated EPSS score stands at 0.9435 with no indicated change since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27341
Vulnerability details
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.