Cyber Resilience

CVE-2024-36046

Critical

Published: 27 February 2025

Published
27 February 2025
Modified
10 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0026 49.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-36046 is a critical-severity Improper Privilege Management (CWE-269) vulnerability in Infoblox Nios. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-7 (Least Functionality).

Deeper analysis

CVE-2024-36046 is a critical vulnerability (CVSS score 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting Infoblox NIOS through version 8.6.4. It stems from CWE-269 (Improper Privilege Management), where the software executes with more privileges than required, published on 2025-02-27.

A remote network attacker requires no privileges or user interaction and can exploit the issue with low complexity. Successful exploitation enables high-impact disruption to confidentiality, integrity, and availability, potentially allowing full system compromise.

The Infoblox advisory at https://support.infoblox.com/s/article/000010390 provides details on mitigation.

EU & UK References

Vulnerability details

Infoblox NIOS through 8.6.4 executes with more privileges than required.

CWE(s)
CWE-269

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Remote unauthenticated exploitation of public-facing Infoblox NIOS service due to improper privilege management (CWE-269) directly enables T1190 and results in full system compromise via privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-36047Same product: Infoblox Nios
CVE-2024-37566Same product: Infoblox Nios
CVE-2024-37567Same product: Infoblox Nios
CVE-2025-61880Same product: Infoblox Nios
CVE-2025-61879Same product: Infoblox Nios
CVE-2026-4880Shared CWE-269
CVE-2026-26725Shared CWE-269
CVE-2026-6228Shared CWE-269
CVE-2025-14736Shared CWE-269
CVE-2025-0180Shared CWE-269

Affected Assets

infoblox
nios
8.6.0 — 8.6.4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-6 Least Privilege good match
prevent

Directly enforces the principle of least privilege, mitigating the core issue of software executing with excessive privileges as described in CWE-269.

CM-7 Least Functionality good match
prevent

Limits the system to essential functionality only, reducing the attack surface and necessity for elevated privileges that enable full system compromise.

AC-3 Access Enforcement partial match
prevent

Enforces approved authorizations for access to system resources, helping to contain the impact of processes running with improper privileges.

References