CVE-2024-5514 CRITICAL

CVE-2024-5514: MinMax CMS - Hidden Functionality

Vendor Minmax Digital Technology
Product MinMax CMS
Weakness CWE-798 · Hardcoded credentials
Published May 30, 2024
Last update November 25, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management interface. Remote attackers who obtain this account can bypass IP access control restrictions and log in to the backend system without being recorded in the system logs.

Key dates

02Disclosure timeline

May 30, 2024 CVE published
November 25, 2024 Record updated