CVE-2024-2389 (CVSS 10): Critical Security Flaw Discovered in Progress Flowmon Network Monitoring Tool
Progress, the provider of Flowmon, a widely used network monitoring and security solution, has disclosed a major security vulnerability with a critical CVSS score of 10. The flaw, designated as CVE-2024-2389, could give attackers unfettered access to sensitive network infrastructure.
The Flaw Explained
This vulnerability allows a remote attacker to execute arbitrary system commands on vulnerable Flowmon systems without needing any authentication. This means attackers could potentially:
- Steal sensitive network data and configurations
- Disrupt critical network operations
- Gain a foothold into the broader network for further attacks
Affected Versions
Progress Flowmon versions 11.x and 12.x are confirmed vulnerable. All Flowmon versions prior the 11.0 (10.x and lower) are not affected by the CVE-2024-2389 vulnerability.
No Known Exploits…Yet
While Progress is unaware of any active exploitation of this flaw, the critical severity highlights the potential risk. Cybersecurity experts advise immediate action. Progress thanks David Yesland from Rhino Security Labs for responsibly disclosing this vulnerability.
The Fix: Upgrade Now
Progress has released patched versions to address this vulnerability:
Don’t delay! Install these patches as soon as possible. You can find instructions and download links in the official Progress security advisory. It’s also highly recommended that you upgrade all Flowmon modules to their latest versions.
Security Requires Vigilance
This vulnerability highlights the importance of staying on top of security updates, even for trusted network management tools. Regularly monitor security advisories for the software your organization relies on, and implement patches promptly.
