CVE-2024-36046

Infoblox NIOS through 8.6.4 executes with more privileges than required

Critical · published February 27, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
34.0
In the wild
Unconfirmed
What it is

🚨 A critical privilege escalation vulnerability in Infoblox NIOS could let an attacker waltz in with full admin rights! 🔥 Think of it like a hotel where the staff accidentally left the master key accessible to all guests — anyone could open any door and access anything without proper checks. 😱 With elevated privileges, an attacker could manipulate DNS records, access sensitive data, or even disrupt network services entirely. This could lead to devastating downtime and compromise of valuable information. This is absolutely critical for any organization relying on Infoblox NIOS!

Put simply

Think of it like a hotel where the staff accidentally left the master key accessible to all guests — anyone could open any door and access anything without proper checks. 😱 CVE-2024-36046 allows Infoblox NIOS versions up to 8.6.4 to operate with more privileges than intended, potentially giving unauthorized users elevated access to system functionalities.

What to do

With elevated privileges, an attacker could manipulate DNS records, access sensitive data, or even disrupt network services entirely. This could lead to devastating downtime and compromise of valuable information. This is absolutely critical for any organization relying on Infoblox NIOS! Immediately update Infoblox NIOS to version 8.6.5 or later to patch this vulnerability. Conduct a security audit to ensure no unauthorized access has occurred and review your privilege management policies. You've got this! Fixing this vulnerability will significantly enhance your security posture. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00409 · 34.0th percentile
Published
2025-02-27T00:00Z
EPSS history
Timeline
  • 27 FEB 00:00Z
    Infoblox NIOS through 8.6.4 executes with more privileges than required
    cvelistv5