CVE-2024-2389 | In Flowmon versions prior to 11.1.14 and 12.3.5, an operatin… | CVSS 10.0 CRITICAL

Description

In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands.

Metadata

CVE ID: CVE-2024-2389
State: PUBLISHED
Assigner: ProgressSoftware
Reserved: 2024-03-11 20:53 UTC
Published: 2024-04-02 12:22 UTC
Last updated: 2025-12-16 18:13 UTC
Primary CWE: CWE-78
CWE-78 Improper Neutralization of Special Elements used in a…
Vendor / Product: Progress Software / Flowmon
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Progress Software	Flowmon	—	11.X < 11.1.14, 12.X < 12.3.5

Weakness (CWE)

CWE	Source	Description
CWE-78	cna	CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)