CVE-2024-51558 — Brute Force Attack Vulnerability in Wave 2.0

CVE-2024-51558

Brute Force Attack Vulnerability in Wave 2.0 PUBLISHED

Description (CNA)

This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain unauthorized access and compromise other user accounts.

Affected (CNA)

Vendor / product	Versions
Brokerage Technology Solutions / Wave 2.0	affected <1.1.7

CWE

CWE-307

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.