PT-2025-2806 · Flxeon · Flxeon

Published

2024-10-08

·

Updated

2025-01-29

·

CVE-2024-48849

CVSS v3.1

9.4

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Name of the Vulnerable Software and Affected Versions: FLXEON versions through <= 9.3.4
Description: The issue is related to a lack of origin validation in WebSockets, which allows unauthorized HTTPS requests due to insufficient session management. This can be exploited by a remote attacker to bypass security restrictions and gain unauthorized access to protected information by sending specially crafted HTTPS requests.
Recommendations: For FLXEON versions through <= 9.3.4, consider disabling WebSockets functionality until a patch is available to prevent unauthorized HTTPS requests. Restrict access to sensitive information and implement additional security measures to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-1385

Related Identifiers

BDU:2025-01298
CVE-2024-48849

Affected Products

Flxeon