What’s Vulnerable › Vulnerabilities

CVE-2024-0390: Hard-coded credentials in iZZi connect application

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-15 · updated 2026-06-17
• Weakness: CWE-798

Description

INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access to manage and read parameters of the recuperation unit "reQnet iZZi".This issue affects "iZZi connect" application versions before 2024010401.

Affected products

• INPRAX iZZi connect: before 2024010401 — fixed in 2024010401

How to fix

Upgrade to a fixed version: INPRAX iZZi connect 2024010401. Check the vendor advisory for mitigations.

References

• https://cert.pl/en/posts/2024/02/CVE-2024-0390/
• https://cert.pl/posts/2024/02/CVE-2024-0390/
• https://cert.pl/en/posts/2024/02/CVE-2024-0390/
• https://cert.pl/posts/2024/02/CVE-2024-0390/

Get alerted when CVE-2024-0390 or the next vulnerability affects your stack