PT-2024-4419 · Ifm · Ifm Qva200+2

Published 2024-05-27 · Updated 2024-06-07 · CVE-2024-5404

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions moneo appliance (affected versions not specified) IFM QHA300 (affected versions not specified) IFM QHA210 (affected versions not specified) IFM QVA200 (affected versions not specified)

Description An unauthenticated remote attacker can change the admin password in a moneo appliance due to a weak password recovery mechanism. The vulnerability is related to the "Forgot Password" function of the IIoT platform.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

BDU:2024-04918

CVE-2024-5404

Affected Products

Ifm Qha210

Ifm Qha300

Ifm Qva200

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-5404 · Security Note
• https://bdu.fstec.ru/vul/2024-04918 · Security Note
• https://twitter.com/the_yellow_fall/status/1797805492305330481 · Twitter Post
• https://cert.vde.com/en/advisories/VDE-2024-028 · Note
• https://t.me/pentestingnews/47664 · Telegram Post
• https://twitter.com/Dinosn/status/1797851535881457697 · Twitter Post
• https://securityonline.info/cve-2024-5404-critical-vulnerability-found-in-moneo-iiot-platform · Note
• https://twitter.com/cracbot/status/1797870992498577596 · Twitter Post
• https://twitter.com/cracbot/status/1799320498301747548 · Twitter Post
• https://twitter.com/fridaysecurity/status/1797806201612157124 · Twitter Post
• https://t.me/cvenotify/81722 · Telegram Post
• https://ifm.com/au/en/shared/moneo · Note
• https://vuldb.com/ru/?id.266882 · Note
• https://twitter.com/cracbot/status/1798958119336435850 · Twitter Post
• https://ifm.com/au/en/shared/moneo-iiot-platform/products/technical-requirements-and-information-moneo · Note