CVE-2024-33898

2024-06-2400:00:00

mitre

github.com

axiros

acs

access control

remote code execution

AI Score

8.1

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 has Incorrect Access Control. An authorization bypass allows remote attackers to achieve unauthenticated remote code execution.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:axiros:axess:4.0:*:*:*:*:*:*:*"
    ],
    "vendor": "axiros",
    "product": "axess",
    "versions": [
      {
        "status": "affected",
        "version": "4.0",
        "lessThan": "5.0.0",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:axiros:axess:5.0.0:*:*:*:*:*:*:*"
    ],
    "vendor": "axiros",
    "product": "axess",
    "versions": [
      {
        "status": "affected",
        "version": "5.0.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]