Cyber Resilience

CVE-2024-54820

Critical

Published: 24 February 2025

Published
24 February 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0210 84.4th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-54820 is a critical-severity SQL Injection (CWE-89) vulnerability in Xone (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-54820 is a SQL injection vulnerability (CWE-89) in XOne Web Monitor v02.10.2024.530 using framework 1.0.4.9. The issue exists in the login page, where attackers can use crafted input to extract all usernames and passwords from the database. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-02-24.

Unauthenticated attackers with network access can exploit the vulnerability remotely with low complexity and no user interaction required. Exploitation enables extraction of all stored credentials, with high impacts on confidentiality, integrity, and availability as scored by CVSS.

Advisories and further details are available in the GitHub repository at https://github.com/jcarabantes/CVE-2024-54820 and on the vendor site at https://xone.es/.

EU & UK References

Vulnerability details

XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerability allows attackers to extract all usernames and passwords via a crafted input.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in unauthenticated login of public-facing web app directly enables remote exploitation for credential access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89
CVE-2025-22691Shared CWE-89

Affected Assets

Xone
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents SQL injection vulnerabilities by validating and sanitizing crafted inputs on the login page before they reach the database.

SI-2 Flaw Remediation good match
prevent

Requires identification, reporting, and timely remediation of flaws like this SQL injection in the login page to eliminate the vulnerability.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Vulnerability monitoring and scanning detects SQL injection issues in web applications such as the login page of XOne Web Monitor.

References