CVE-2024-51558

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain unauthorized access and compromise other user accounts.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
Brokerage Technology Solutions	Wave 2.0	<1.1.7
brokeragetechnologysolutions	wave_2.0	< 1.1.7

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332Third Party Advisory

Timeline

Published: Nov 4, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-515596.5This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker co CVE-2024-51566.4The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and inclu CVE-2024-515604.3This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated re CVE-2024-515617.5This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remo CVE-2024-515626.5The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value.CVE-2024-515636.5The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition.CVE-2024-515647.5A guest can trigger an infinite loop in the hda audio driver.CVE-2024-515656.5The hda driver is vulnerable to a buffer over-read from a guest-controlled value.CVE-2024-515666.5The NVMe driver queue processing is vulernable to guest-induced infinite loops.CVE-2024-515679.8upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and CVE-2024-515689.8CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There CVE-2024-515697.5Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound