PT-2025-16231 · Softcom · Softcom Iksoris Internet Starter

Paweł Zdunek · Published 2025-04-14 · Updated 2025-11-20 · CVE-2024-49705

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0

Description: The issue is related to client-side Denial of Service (DoS) attacks. An attacker can trick a user into using a URL with a d parameter set to an unhandled value, causing the server to return an error message and preventing subsequent requests from being accepted. This issue persists until the session expires or the user manually deletes cookies. A similar effect can be achieved when a user attempts to change the platform language to an unimplemented one.

Recommendations: For versions prior to 79.0, update to version 79.0 to resolve the issue. As a temporary workaround, consider clearing session cookies to restore functionality. Avoid using URLs with unhandled d parameter values and refrain from attempting to change the platform language to unimplemented options until the update is applied.

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2024-49705

Affected Products

Softcom Iksoris Internet Starter

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-49705 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49705 · Vendor Advisory
• https://twitter.com/CVEnew/status/1911767832905253130 · Twitter Post
• https://t.me/cvetracker/21524 · Telegram Post
• https://iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html · Note
• https://cert.pl/en/posts/2025/04/CVE-2024-10087 · Note
• https://t.me/cveNotify/140719 · Telegram Post
• https://t.me/cvedetector/22850 · Telegram Post
• https://twitter.com/dailycve/status/1991627371145998543 · Twitter Post