CVE-2024-37566

Critical

Published: 27 February 2025

Published

27 February 2025

Modified

10 April 2025

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0027 51.0th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-37566 is a critical-severity Improper Access Control (CWE-284) vulnerability in Infoblox Nios. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SC-7 (Boundary Protection).

Deeper analysis

CVE-2024-37566 is an improper authentication vulnerability (CWE-284) in Infoblox NIOS through version 8.6.4, specifically affecting Grid functionality. Published on 2025-02-27, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.

Unauthenticated attackers with network access can exploit this vulnerability with low attack complexity and no user interaction required. Successful exploitation enables high-impact outcomes, including unauthorized access leading to confidentiality breaches, integrity modifications, and availability disruptions on affected NIOS Grid deployments.

Infoblox has published mitigation guidance in their support article at https://support.infoblox.com/s/article/000010392. Security practitioners should consult this advisory for patching instructions and workarounds applicable to NIOS versions through 8.6.4.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-53954

Vulnerability details

Infoblox NIOS through 8.6.4 has Improper Authentication for Grids.

CWE(s): CWE-284

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Improper authentication (CWE-284) in a network-exposed Grid service directly enables remote unauthenticated exploitation of a public-facing application with no user interaction.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1