CVE-2024-51558
CRITICAL63moons Wave 2.0 < 1.1.7 - Unauthenticated Brute Force Attack via API Login
Title source: llmDescription
This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain unauthorized access and compromise other user accounts.
References (1)
Core 1
Core References
Third Party Advisory third-party-advisory
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332
Scores
CVSS v3
9.8
EPSS
0.0055
EPSS Percentile
41.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-307
Status
published
Products (2)
63moons/aero
< 120820241550
63moons/wave_2.0
< 1.1.7
Published
Nov 04, 2024
Tracked Since
Feb 18, 2026