What’s Vulnerable › Vulnerabilities

CVE-2024-48932: ZimaOS Unauthenticated API Discloses Usernames

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-10-24 · updated 2026-06-17
• Weakness: CWE-284

Description

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint `http://<Server-ip>/v1/users/name` allows unauthenticated users to access sensitive information, such as usernames, without any authorization. This vulnerability could be exploited by an attacker to enumerate usernames and leverage them for further attacks, such as brute-force or phishing campaigns. As of time of publication, no known patched versions are available.

Affected products

• IceWhaleTech ZimaOS: before 1.2.5 — fixed in 1.2.5

How to fix

Upgrade to a fixed version: IceWhaleTech ZimaOS 1.2.5. Check the vendor advisory for mitigations.

References

• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-57r9-43pc-gcp2
• https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-9mrr-px2c-w42c
• https://youtu.be/wJFq8cuyFm4

Get alerted when CVE-2024-48932 or the next vulnerability affects your stack