What’s Vulnerable › Vulnerabilities

CVE-2024-8779: The SYSCOM Group OMFLOW - Broken Access Control

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-16 · updated 2026-06-17
• Weakness: CWE-284

Description

OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privileges to update system settings or create accounts with administrator privileges, thereby gaining control of the server.

Affected products

• The SYSCOM Group OMFLOW: from 1.1.6.0 before 1.2.1.3 — fixed in 1.2.1.3

How to fix

Upgrade to a fixed version: The SYSCOM Group OMFLOW 1.2.1.3. Check the vendor advisory for mitigations.

References

• https://www.twcert.org.tw/en/cp-139-8076-6ade0-2.html
• https://www.twcert.org.tw/tw/cp-132-8075-a0d06-1.html

Get alerted when CVE-2024-8779 or the next vulnerability affects your stack