CVE-2024-57490
Published: 21 March 2025
Summary
CVE-2024-57490 is a high-severity Improper Authentication (CWE-287) vulnerability in Ioffice Ioffice20. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-2 (Identification and Authentication (Organizational Users)) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-57490 is an improper authentication vulnerability (CWE-287) in Guangzhou Hongfan Technology Co., LTD.'s iOffice20 software. Published on 2025-03-21 with a CVSS v3.1 base score of 7.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L), it stems from a logical flaw that allows unauthorized access to any user account, including the system administrator, without valid credentials.
Remote attackers with network access can exploit this vulnerability despite requiring high attack complexity and no privileges or user interaction. Successful exploitation grants full login access to arbitrary accounts, enabling high-impact confidentiality and integrity violations such as data exfiltration, privilege escalation, and system modification, with low availability disruption.
Advisories and additional details are referenced at https://gist.github.com/NaliangzzZ/44bfcc1d9c2cf275d2b6683ca9e20980 and https://www.ioffice.cn.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7252
Vulnerability details
Guangzhou Hongfan Technology Co., LTD. iOffice20 has any user login vulnerability. An attacker can log in to any system account including the system administrator through a logical flaw.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The improper authentication vulnerability in a network-accessible application directly enables remote exploitation of a public-facing app for initial access (T1190) and exploitation of the software flaw to gain administrator privileges (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates unique identification and authentication for organizational users, directly countering the logical flaw enabling unauthorized login to any account including administrator without credentials.
Requires timely identification, reporting, and remediation of flaws such as the improper authentication vulnerability in iOffice20, eliminating the exploit path.
Enforces approved access authorizations post-authentication, providing a secondary barrier against unauthorized access granted by the authentication bypass.