CVE-2024-37567

Infoblox NIOS through 8.6.4 has Improper Access Control for Grids

Critical · published February 27, 2025

CVSS v3.1
9.1
EPSS
0%
Percentile
27.9
In the wild
Unconfirmed
What it is

🚨 A serious access control flaw lurks in Infoblox NIOS versions up to 8.6.4! 🚨 Think of this vulnerability like a hotel front desk that gives out room keys without verifying who’s asking — any guest could wander into any room, no questions asked! This oversight could allow an unauthorized user to access sensitive configurations and data across grids, leading to potentially catastrophic changes or exposure of crucial network information. It's a wide-open door to misconfigurations and breaches that could put your entire infrastructure at risk!

Put simply

Think of this vulnerability like a hotel front desk that gives out room keys without verifying who’s asking — any guest could wander into any room, no questions asked! This improper access control vulnerability permits users to perform unauthorized actions on grids, as the system fails to properly validate permissions before granting access. It can lead to administrative access being granted to users who shouldn't have it at all.

What to do

This oversight could allow an unauthorized user to access sensitive configurations and data across grids, leading to potentially catastrophic changes or exposure of crucial network information. It's a wide-open door to misconfigurations and breaches that could put your entire infrastructure at risk! Immediately update to the patched version beyond 8.6.4 to close this glaring gap. Review your access control policies to ensure that only authorized personnel can access sensitive configurations. Conduct a thorough audit of your existing grid permissions to identify any unauthorized access! You've got this! By taking swift action, you'll ensure your networks remain safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.9th percentile
Published
2025-02-27T00:00Z
EPSS history
Timeline
  • 27 FEB 00:00Z
    Infoblox NIOS through 8.6.4 has Improper Access Control for Grids
    cvelistv5