CVE-2024-2389 - CVE House
Back to Database
Status published Critical CVE-2024-2389

Flowmon Unauthenticated Command Injection Vulnerability

Vulnerability Description

In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.  An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-2389

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Rhino Security Labs - David Yesland

References

More from Progress Software

View All →
CVE-2025-8868
Chef Automate compliance service SQL Injection Vulnerability
Critical 9.8
CVE-2025-6725
Cross-Site Scripting (XSS) in PdfViewer
Medium 5.4
CVE-2025-6724
Chef Automate SQL Injection Vulnerability
High 8.8
CVE-2025-6723
Untrusted user data can lead to privilege escalation
Medium 5.8
CVE-2025-6505
Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of...
High 8.1

Affected Vendor

Progress Software

View all reports →

Affected Software

Flowmon
Vulnerable Versions:
11.X, 12.X

Timeline

Official Publish: April 2nd, 2024
Last Modified: December 16th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration