What is CVE-2024-35295?

CVE-2024-35295 is a medium-severity vulnerability in Innomotics Perfect Harmony Gh180, classified under Missing Authentication for Critical Function. CVSS score: 6.1/10. Published 2025-06-11.

How severe is CVE-2024-35295?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Auth bypass in Innomotics Perfect Harmony Gh180

CVE-2024-35295

A vulnerability has been identified in Perfect Harmony GH180 (All versions >= V8.0 < V8.3.3 with NXGPro+ controller manufactured between April 2020 to April 2025). The maintenance connection of affected devices fails to protect access to the device's control unit configuration. This could allow an attacker with physical access to the maintenance connection's door port to perform arbitrary configuration changes.

Vulnerability class: Broken Authentication

EPSS: 0.002 (8.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

Affected products

Innomotics Perfect Harmony Gh180 — versions V8.0

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

Frequently asked questions

What is CVE-2024-35295?: CVE-2024-35295 is a medium-severity vulnerability in Innomotics Perfect Harmony Gh180, classified under Missing Authentication for Critical Function. CVSS score: 6.1/10. Published 2025-06-11.
How severe is CVE-2024-35295?: Medium severity. CVSS v3 base score is 6.1 out of 10.