What’s Vulnerable › Vulnerabilities

CVE-2024-13061: 2100 Technology Electronic Official Document Management System - Authentication Bypass

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-31 · updated 2026-06-17
• Weakness: CWE-290

Description

The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability. Although the product enforces an IP whitelist for the API used to query user tokens, unauthenticated remote attackers can still deceive the server to obtain tokens of arbitrary users, which can then be used to log into the system.

Affected products

• 2100 Technology Electronic Official Document Management System: before 5.0.86.9 — fixed in 5.0.86.9

How to fix

Upgrade to a fixed version: 2100 Technology Electronic Official Document Management System 5.0.86.9. Check the vendor advisory for mitigations.

References

• https://www.chtsecurity.com/news/255984da-6630-4e25-ba9b-5ce6933935a6
• https://www.chtsecurity.com/news/ade9e9af-61d0-4e3c-8aa0-e8524ee2cfbc
• https://www.twcert.org.tw/en/cp-139-8340-d8b16-2.html
• https://www.twcert.org.tw/tw/cp-132-8339-570fa-1.html

Get alerted when CVE-2024-13061 or the next vulnerability affects your stack