CVE-2024-0390

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access to manage and read parameters of the recuperation unit "reQnet iZZi".This issue affects "iZZi connect" application versions before 2024010401.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
INPRAX	iZZi connect	< 2024010401

References

https://cert.pl/en/posts/2024/02/CVE-2024-0390/Third Party Advisory
https://cert.pl/posts/2024/02/CVE-2024-0390/Third Party Advisory
https://cert.pl/en/posts/2024/02/CVE-2024-0390/Third Party Advisory
https://cert.pl/posts/2024/02/CVE-2024-0390/Third Party Advisory

Timeline

Published: Feb 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-03914.3The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existen CVE-2024-03925.4A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CVE-2024-03947.8Rapid7 Minerva Armor versions below 4.5.5 suffer from a privilege escalation vulnerability whereby an authenticated attacker can elevate pri CVE-2024-03967.1In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an inpu CVE-2024-03977.4A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats(CVE-2024-03998.1The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL st CVE-2024-04007.5SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for custom CVE-2024-04017.2ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can e CVE-2024-04029.9An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.CVE-2024-04036.5Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. This is possible because the application is vulnerabl CVE-2024-04049.1A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthoriz CVE-2024-04056.5The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via