VulnerabilityDeferred

CVE-2024-5514

Remote attackers who obtain this account can bypass IP access control restrictions and log in to the backend system without being recorded in the system logs.

CRITICAL 9.8EPSS 0.65%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management interface. Remote attackers who obtain this account can bypass IP access control restrictions and log in to the backend system without being recorded in the system logs.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.65% probability · 49th percentile
CISA KEV: Not listed
Weakness: CWE-798, CWE-912
Source: twcert@cert.org.tw

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.