VulnerabilityAnalyzed

CVE-2024-8777

OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system configurations.

HIGH 7.5EPSS 0.54%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system configurations. If LDAP authentication is enabled, attackers can obtain plaintext credentials.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.54% probability · 44th percentile
CISA KEV: Not listed
Weakness: CWE-200, CWE-522
Affected: syscomgo/omflow
Source: twcert@cert.org.tw

References

https://www.twcert.org.tw/en/cp-139-8072-928a5-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-8071-46589-1.htmlThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.