CVE-2024-45168

CRITICAL

uci idol2 < 2.12 - Missing Authorization via Raw Socket Communication

Title source: llm

Description

An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is transferred over a raw socket without any authentication mechanism. Thus, communication endpoints are not verifiable.

References (5)

Core 5

Core References

Broken Link

http://download.uci.de/idol2/idol2Client_2_12.exe

Product, Release Notes

https://uci.de/download/idol2-client.html

Product

https://uci.de/products/index.html

Product

https://www.syss.de/en/responsible-disclosure-policy

Exploit, Third Party Advisory

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-049.txt

Scores

CVSS v3 9.1

EPSS 0.0069

EPSS Percentile 48.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-862

Status published

Products (1)

uci/idol2 < 2.12

Published Aug 22, 2024

Tracked Since Feb 18, 2026