What’s Vulnerable › Vulnerabilities

CVE-2024-13040: Quanta Computer QOCA aim - Authorization Bypass

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-31 · updated 2026-06-17
• Weakness: CWE-639

Description

The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to privilege escalation.

Affected products

• Quanta Computer QOCA aim AI Medical Cloud Platform: 0

References

• https://www.twcert.org.tw/en/cp-139-8337-7899f-2.html
• https://www.twcert.org.tw/tw/cp-132-8336-aa03b-1.html

Get alerted when CVE-2024-13040 or the next vulnerability affects your stack