CVE-2024-23815

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highly protected zone), Desigo CC (All versions if access from Installed Clients to Desigo CC server is only allowed within highly protected zones). The affected server application fails to authenticate specific client requests. Modification of the client binary could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database via the event port (default: 4998/tcp)

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
May 13, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-238169.8A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location IntelligenCVE-2024-238176.1Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML InjCVE-2024-238184.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scriptiCVE-2024-238194.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scriptiCVE-2024-23825.3The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including,CVE-2024-238206.5OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that CVE-2024-238214.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scriptiCVE-2024-238229.8Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file uplCVE-2024-238236.5vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-ParCVE-2024-238242.7mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood CVE-2024-238254.9TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided byCVE-2024-238265.7spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an