Description

Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An authorization bypass allows remote attackers to achieve unauthenticated remote code execution.

Classification

CVE ID: CVE-2024-33898

Affected Products

Vendor: n/a

Product: n/a

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 11.87% (scored less or equal to compared to others)

EPSS Date: 2025-03-07 (when was this score calculated)

References

https://www.axiros.com/2024/03/vulnerability-in-axusermanager
https://www.nsideattacklogic.de/advisories/NSIDE-SA-2024-002

Timeline