CVE-2024-51558 Brute Force Attack Vulnerability in Wave 2.0

Critical 9.3 Published 4 Nov 2024 Updated 4 Nov 2024

Remote attackers can brute force login credentials due to missing rate limiting, leading to unauthorized account access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-51558?

CVE-2024-51558 is a critical authentication bypass vulnerability in Brokerage Technology Solutions Wave 2.0, published on 4 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain unauthorized access and compromise other user accounts.

Weakness: CWE-307

Which versions are affected by CVE-2024-51558?

It affects 2 products.

Products include 63moons Aero, 63moons Wave 2.0.

How do I fix CVE-2024-51558?

No fix has been published for CVE-2024-51558 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-51558 being exploited?

There is no known exploitation of CVE-2024-51558 in the wild and no public exploit code.

Sources

Also known as GHSA-9xwg-wxgq-6vph.