CVE-2024-23637 - CVE House
Back to Database
Status published Medium CVE-2024-23637

OctoPrint Unverified Password Change via Access Control Settings

Vulnerability Description

OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-23637

Credits & Attribution

No credits recorded in the NVD database.

References

More from OctoPrint

View All →
CVE-2025-64187
OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts
Medium 4.6
CVE-2025-58180
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
High 7.5
CVE-2025-48879
OctoPrint Vulnerable to Denial of Service through malformed HTTP request
Medium 6.5
CVE-2025-48067
OctoPrint vulnerable to possible file extraction via upload endpoints
Medium 5.4
CVE-2025-32788
OctoPrint Authenticated Reverse Proxy Page Authentication Bypass
Medium 4.3

Affected Vendor

Affected Software

OctoPrint
Vulnerable Versions:
< 1.10.0rc1

Timeline

Official Publish: January 31st, 2024
Last Modified: June 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-287 CWE-620

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access