CVE-2024-42176
Published: 19 March 2025
Summary
CVE-2024-42176 is a low-severity Improper Restriction of Excessive Authentication Attempts (CWE-307) vulnerability in Hcltech Dryice Myxalytics. Its CVSS base score is 2.6 (Low).
Operationally, ranked at the 37.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-10 (Concurrent Session Control) and AC-12 (Session Termination).
Deeper analysis
CVE-2024-42176 is a concurrent login vulnerability in HCL MyXalytics, where the software permits simultaneous active sessions for a single set of credentials. This flaw, classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), enables potential unauthorized access to a user's account or sensitive information. The vulnerability received a CVSS v3.1 base score of 2.6 (AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N), indicating low severity with network accessibility but high attack complexity, requirement for low-privilege access, and user interaction.
An attacker with low privileges (PR:L) could exploit this over the network (AV:N), though it demands high complexity (AC:H) and user interaction (UI:R), such as tricking the user into concurrent login actions. Successful exploitation would grant limited confidentiality impact (C:L), allowing the attacker to potentially access the user's account or sensitive data without affecting integrity or availability.
Mitigation details are outlined in the HCL Software advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0119919.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6728
Vulnerability details
HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a single credential allowing an attacker to potentially obtain access to a user's account or sensitive information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly limits the number of concurrent sessions per account, preventing simultaneous active sessions for a single set of credentials as exploited in this CVE.
Automatically terminates sessions based on defined conditions, reducing the risk and duration of concurrent session exploitation.
Notifies users upon login of previous logon activity, enabling detection of potential unauthorized concurrent sessions.