CVE-2024-2389

Flowmon Unauthenticated Command Injection Vulnerability

In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands.

Affected

Progress Software · Flowmon

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 PROGRESS

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

93.04% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical · CWE-78

Published

2024-04-02

Updated

2025-12-16

Proof-of-concept exploits (3)

• YN1337/exploit0★ · 2024-06-04
• adhikara13/CVE-2024-23892★ · 2024-04-11
• getdrive/PoC73★ · 2024-08-12

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2389.yaml

Metasploit modules (2)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/progress_flowmon_unau…
• rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/progress_flowmon_sud…

Exploit collections (1)

• CVE-2024-2389.yamlzan8in/afrog

Security advisories

• https://support.kemptechnologies.com/hc/en-us/articles/24878235038733-CVE-2024-2389-Flowm…
• https://www.flowmon.com

References

• CVE Record
• NVD entry

Related

• CVE-2023-42793
• CVE-2024-1212
• CVE-2024-24919
• CVE-2022-44268
• CVE-2022-4510
• CVE-2023-23752