CVE-2024-8779
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privileges to update system settings or create accounts with administrator privileges, thereby gaining control of the server.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| The SYSCOM Group | OMFLOW | 1.1.6.0 <= 1.2.1.2 | affected |
Weaknesses
- CWE-284: CWE-284 Improper Access Control
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://www.twcert.org.tw/tw/cp-132-8075-a0d06-1.html
- https://www.twcert.org.tw/en/cp-139-8076-6ade0-2.html
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.