CVE-2024-57778
Published: 14 February 2025
Summary
CVE-2024-57778 is a high-severity Improper Privilege Management (CWE-269) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly counters CWE-269 Improper Privilege Management by enforcing least privilege, preventing remote attackers from escalating from no privileges via flawed server responses.
Mandates secure error handling to ensure HTTP 500 responses do not transition insecurely to 200 status codes, blocking the privilege escalation vector.
Enforces approved access authorizations, mitigating privilege escalation attempts triggered by anomalous server response status changes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE directly describes a remote privilege escalation exploit via improper privilege management (CWE-269), mapping to T1068 Exploitation for Privilege Escalation.
NVD Description
An issue in Orbe ONetView Roeador Onet-1200 Orbe 1680210096 allows a remote attacker to escalate privileges via the servers response from status code 500 to status code 200.
Deeper analysisAI
CVE-2024-57778 is a privilege escalation vulnerability in Orbe ONetView Roeador Onet-1200 Orbe 1680210096. The issue allows a remote attacker to escalate privileges by leveraging the server's response transition from HTTP status code 500 to status code 200. It carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-269 (Improper Privilege Management). The vulnerability was published on 2025-02-14.
A remote attacker on an adjacent network can exploit this vulnerability with low complexity and no required privileges or user interaction. Successful exploitation enables high-impact confidentiality, integrity, and availability compromises in an unchanged security scope, effectively allowing privilege escalation on the affected system.
Mitigation details and additional information are available in the referenced advisory at https://github.com/KUK3N4N/CVE-2024-57778.
Details
- CWE(s)