{"id":"CVE-2024-2389","published":"2024-04-02T12:22:45Z","modified":"2025-12-16T18:13:17Z","title":"Flowmon Unauthenticated Command Injection Vulnerability","vendor":"Progress Software","product":"Flowmon","tier":"core","eol":null,"affectedVersions":[{"vendor":"Progress Software","product":"Flowmon","versions":[">= 11.X, < 11.1.14",">= 12.X, < 12.3.5"]}],"description":{"text":"In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.  An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands.\n\n","provenance":"source","from":"CVE.org"},"summary":{"text":"Flowmon, from Progress Software, contains an OS command injection flaw in its management interface (the Flowmon management interface component) affecting versions prior to 11.1.14 and 12.3.5. An attacker who can reach that management interface over the network can execute arbitrary system commands on the host without authenticating and without any user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:39Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.93037,"percentile":0.99832,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-04-26","exploitedFirstSeen":"2024-04-26","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-26&host_type=src&vulnerability=cve-2024-2389","date":"2024-04-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-27&host_type=src&vulnerability=cve-2024-2389","date":"2024-04-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-28&host_type=src&vulnerability=cve-2024-2389","date":"2024-04-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-29&host_type=src&vulnerability=cve-2024-2389","date":"2024-04-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-30&host_type=src&vulnerability=cve-2024-2389","date":"2024-04-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-01&host_type=src&vulnerability=cve-2024-2389","date":"2024-05-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-02&host_type=src&vulnerability=cve-2024-2389","date":"2024-05-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-03&host_type=src&vulnerability=cve-2024-2389","date":"2024-05-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-04&host_type=src&vulnerability=cve-2024-2389","date":"2024-05-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-05&host_type=src&vulnerability=cve-2024-2389","date":"2024-05-05"}],"evidenceTotal":467,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.flowmon.com","tags":["product"]},{"url":"https://support.kemptechnologies.com/hc/en-us/articles/24878235038733-CVE-2024-2389-Flowmon-critical-security-vulnerability","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-27341","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-27341","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-04-11","earliestUrl":"https://github.com/adhikara13/CVE-2024-2389","repos":[{"name":"adhikara13/CVE-2024-2389","url":"https://github.com/adhikara13/CVE-2024-2389","stars":2,"created":"2024-04-11"}]},"metasploit":[{"name":"Progress Flowmon Local sudo privilege escalation","module":"exploit/linux/local/progress_flowmon_sudo_privesc_2024","type":"exploit","disclosureDate":"2024-03-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb"},{"name":"Flowmon Unauthenticated Command Injection","module":"exploit/linux/http/progress_flowmon_unauth_cmd_injection","type":"exploit","disclosureDate":"2024-04-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/progress_flowmon_unauth_cmd_injection.rb"}],"nuclei":[{"id":"CVE-2024-2389","name":"Progress Kemp Flowmon - Command Injection","severity":"critical","path":"http/cves/2024/CVE-2024-2389.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2389.yaml"}],"first":{"date":"2024-03-19","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-03-19","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-04-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb","provenance":"source"},{"date":"2024-04-02","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-2389","provenance":"source"},{"date":"2024-04-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-26&host_type=src&vulnerability=cve-2024-2389","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":67.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 918 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9983"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 2 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}