CVE-2024-5514 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management interface. Remote attackers who obtain this account can bypass IP access control restrictions and log in to the backend system without being recorded in the system logs.

Reserved 2024-05-30 | Published 2024-05-30 | Updated 2024-11-25 | Assigner twcert

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-798 Use of Hard-coded Credentials

CWE-912: Hidden Functionality

Product status

Default status

unaffected

unknown

affected

References

www.twcert.org.tw/tw/cp-132-7828-c08b8-1.html third-party-advisory

www.twcert.org.tw/en/cp-139-7831-b9a46-2.html third-party-advisory

www.chtsecurity.com/.../2dde8d39-59fc-4c09-b4ad-0acf692321c5 third-party-advisory

www.chtsecurity.com/.../6b2393f5-3041-4011-b2ea-528e312c6b3c third-party-advisory

cve.org (CVE-2024-5514)

nvd.nist.gov (CVE-2024-5514)

Download JSON

https://cve.threatint.com/CVE/CVE-2024-5514

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.