CVE-2024-2412: Heimavista Rpage and Epage - Broken Access Control

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-13 · updated 2026-06-17
Weakness: CWE-1220

Description

The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user registration on sites where user registration is supposed to be disabled.

Affected products

Heimavista Epage: through 3.0.106.20231112
Heimavista Rpage: through 5.4.103.20231111

References

https://www.twcert.org.tw/tw/cp-132-7696-0951f-1.html
https://www.twcert.org.tw/tw/cp-132-7696-0951f-1.html

Get alerted when CVE-2024-2412 or the next vulnerability affects your stack