Skip to content
OpenAdvisories
Critical VDE-2024-028 1 CVE

ifm moneo password reset can be exploited

Published May 6, 2024 · Updated Jan 15, 2026 · Revision 11

Vendor: ifm electronic Product: moneo Product: QHA210 Product: QHA300 Product: QVA200

Summary

moneo \"Forgot Password\" function has a vulnerability which allows gaining privileged access.

Details

Impact
In a moneo appliance with no mailserver configured, an unauthorized attacker can reset a password to the new user default value.

Mitigation
The correct configuration of a mail server prevents the exploitation of the vulnerability.

Remediation
Update to moneo version 1.13.5 or later.

Vulnerabilities 1

Revision history

  1. #11.0.0

    add cpe product identifier to Hardware and Software

  2. #10.0.0

    changed Windows form product name to product family and fixed the version range, added CPEs

  3. #9.0.0

    fixed: * initial release date * spacing in version ranges * reference category

  4. #8.0.0

    fix TLP to white

  5. #7.0.0

    Update: changed affected products group

  6. #6.0.0

    Fix: added self-reference

  7. #5.0.0

    no security relevant changes changed URLs from cert-vde.com to certvde.com revamped product tree

  8. #4.0.0

    Update after review

  9. #3.0.0

    Update

  10. #2.0.0

    final draft

  11. #1.0.0

    initial revision

References