CVE-2024-8779

Published: Sep 16, 2024Modified: Sep 17, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: twcert@cert.org.tw (Secondary)

Description

OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privileges to update system settings or create accounts with administrator privileges, thereby gaining control of the server.

Affected (1)

Products: Syscomgo: Omflow

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Syscomgo Omflow	From 1.1.6.0 to 1.2.1.3

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://www.twcert.org.tw/en/cp-139-8076-6ade0-2.html

Source: twcert@cert.org.tw

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-8075-a0d06-1.html

Source: twcert@cert.org.tw

Third Party Advisory

Timeline

No history available yet.