What’s Vulnerable › Vulnerabilities

CVE-2024-5514: MinMax CMS - Hidden Functionality

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-30 · updated 2026-06-17
• Weakness: CWE-798

Description

MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management interface. Remote attackers who obtain this account can bypass IP access control restrictions and log in to the backend system without being recorded in the system logs.

Affected products

• MINMAX: all versions

References

• https://www.chtsecurity.com/news/2dde8d39-59fc-4c09-b4ad-0acf692321c5
• https://www.chtsecurity.com/news/6b2393f5-3041-4011-b2ea-528e312c6b3c
• https://www.twcert.org.tw/en/cp-139-7831-b9a46-2.html
• https://www.twcert.org.tw/tw/cp-132-7828-c08b8-1.html
• https://www.twcert.org.tw/tw/cp-132-7828-c08b8-1.html

Get alerted when CVE-2024-5514 or the next vulnerability affects your stack