Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-37393 is a high-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Securenvoy Multi-Factor Authentication Solutions. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked in the top 12% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-37393 affects SecurEnvoy MFA versions before 9.4.514 and stems from multiple LDAP injection flaws caused by insufficient validation of user-supplied input. The vulnerable component is the DESKTOP service reachable over the unauthenticated /secserver HTTP endpoint, which interacts with Active Directory.
An unauthenticated remote attacker can exploit the issue via blind LDAP injection to exfiltrate sensitive directory data, including the ms-Mcs-AdmPwd attribute that stores cleartext passwords used by the Local Administrator Password Solution (LAPS) feature. The vulnerability carries a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, and high confidentiality impact without requiring privileges or user interaction.
Vendor references point to SecurEnvoy support resources for remediation guidance, while the associated EPSS score has remained flat at its peak value of 0.8466 since disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36632
Vulnerability Data
Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver…
more
HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.2.5
Mitigating Controls (NIST 800-53 r5) AI
SC-8 directly requires protecting confidentiality of transmitted information, which structurally eliminates cleartext transmission of sensitive data.
Developer testing and evaluation can discover SQLi flaws before deployment but does not stop their introduction.
Input validation directly stops untrusted data from reaching SQL query construction without neutralization.
Secure engineering principles require parameterized queries and input sanitization that structurally eliminate SQLi.
System monitoring can identify attempted SQLi exploitation via anomalous queries after the weakness exists.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encryption of data-in-transit directly prevents cleartext transmission while the control also addresses integrity and availability.
Secure SDLC practices directly target injection flaws during coding and review so largely prevent CWE-89 introduction, yet the single broad outcome leaves residual risk from incomplete neutralization techniques or missed edge cases.
Training raises developer awareness of SQLi risks and can reduce introduction likelihood (partial) but removes none of the actual coding flaw's risk by itself since technical neutralization is still required.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Specifying encryption and other security technology for network services prevents transmission of sensitive information in cleartext over potentially untrusted channels.
The same secure-coding and static-analysis activities surface missing neutralization of SQL metacharacters before the system is accepted.
Mandating cryptographic protection and stronger authentication on public networks stops the transmission of plaintext sensitive information.
Early warnings and shared best-practice information help organizations apply the latest remediation techniques against SQL-injection vulnerabilities.
Threat-intelligence feeds that surface new SQL-injection campaigns enable rapid updates to query-construction defenses and detection signatures before exploitation occurs.
Specifying communications-security requirements and secure remote-access methods (including encryption expectations) prevents the transmission of sensitive data in cleartext over home or public networks.