CVE-2024-37567

Critical

Published: 27 February 2025

Published

27 February 2025

Modified

10 April 2025

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0024 47.6th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-37567 is a critical-severity Improper Access Control (CWE-284) vulnerability in Infoblox Nios. Its CVSS base score is 9.1 (Critical).

Operationally, ranked at the 47.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Explicitly authorizes only specific actions without identification or authentication, directly preventing improper unauthenticated access to Infoblox NIOS Grid functionality.

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for logical access to system resources, mitigating the improper access control vulnerability in Grid components.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and remediation of flaws like CVE-2024-37567 through patching, comprehensively addressing the vulnerability.

NVD Description

Infoblox NIOS through 8.6.4 has Improper Access Control for Grids.

Deeper analysisAI

CVE-2024-37567 is an improper access control vulnerability (CWE-284) in Infoblox NIOS versions through 8.6.4, specifically affecting Grid functionality. Published on 2025-02-27, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high impacts on confidentiality and integrity with no availability disruption.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation grants high-level access that compromises confidentiality by exposing sensitive data and integrity by allowing unauthorized modifications, potentially enabling full control over affected Grid components.

Infoblox has published a support advisory detailing mitigation steps at https://support.infoblox.com/s/article/000010393. Security practitioners should consult this reference for patch availability and recommended workarounds applicable to NIOS through 8.6.4.