What is CVE-2024-25656?

CVE-2024-25656 is a medium-severity vulnerability in N/a, classified under Improper Input Validation. CVSS score: 5.9/10. Published 2024-03-18.

How severe is CVE-2024-25656?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Is CVE-2024-25656 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in N/a

CVE-2024-25656

Improper input validation in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS can result in unauthenticated CPE (Customer Premises Equipment) devices storing arbitrarily large amounts of data during registration. This can potentially lead to DDoS attacks on the application database and, ultimately, affect the entire product.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.005 (37.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

References

cve@mitre.org

Frequently asked questions

What is CVE-2024-25656?: CVE-2024-25656 is a medium-severity vulnerability in N/a, classified under Improper Input Validation. CVSS score: 5.9/10. Published 2024-03-18.
How severe is CVE-2024-25656?: Medium severity. CVSS v3 base score is 5.9 out of 10.
Is CVE-2024-25656 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.