CVE-2024-1303: Multiple Vulnerabilities in Badger Meter's Monitool

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-12 · updated 2026-06-17
Weakness: CWE-22

Description

Incorrectly limiting the path to a restricted directory vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows an authenticated attacker to retrieve any file from the device using the download-file functionality.

Affected products

Badger Meter Monitool: before 4.7 — fixed in 4.7

How to fix

Upgrade to a fixed version: Badger Meter Monitool 4.7. Check the vendor advisory for mitigations.

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool

Get alerted when CVE-2024-1303 or the next vulnerability affects your stack