CVE-2024-48852: Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This…

PriorityP261critical9.4CVSS 3.1

AVNACLPRNUINSUCLIHAH

EXPLOIT

EPSS

2.37%

81.8th percentile

Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
abb	flxeon	<= <= 9.3.4	—

Detection & IOCsextracted from sources · hover to see the quote

path/diagnostics/logs-system↗

cookieuser_sid↗

commandjournalctl -b -r --no-hostname ^| head -c 600000↗

path/home/MIX_CMIX/node-server/node_modules/raw-body/index.js↗

path/usr/local/aam/node-server/certs/cbxi.key.pem↗

path/usr/local/aam/node-server/certs/cbxi.cert.pem↗

path/usr/local/aam/node-server/certs/cbxi.csr.pem↗

→Monitor for unauthenticated or authenticated POST requests to the /diagnostics/logs-system endpoint, which is used to retrieve system journal logs and may expose sensitive credential material. ↗
→Detect POST request bodies containing the 'cmd' JSON key with journalctl commands targeting the /diagnostics/logs-system endpoint, indicating log exfiltration attempts. ↗
→System logs exposed via this vulnerability may contain partially redacted OpenSSL passphrase patterns (e.g., pass:c*******2) — monitor log responses for 'passin pass:' strings indicating credential leakage. ↗
→The vulnerability is exploitable remotely with low attack complexity and no privileges required; network-level detection should flag any external access to FLXEON HTTPS management interfaces. ↗

·The exploit uses a session cookie (user_sid) for authentication; however, the vulnerability context (CVE-2024-48849, Missing Origin Validation in WebSockets) suggests session management may be bypassable, meaning the log disclosure endpoint could be reachable without valid credentials. ↗
·Sensitive information (including partially masked passphrases for private key operations) is written to system journal logs and retrievable via the /diagnostics/logs-system API endpoint — the passphrase pattern 'c*******2' suggests a short credential with known first and last characters. ↗
·All FLXEON controller series (FBXi, FBTi, FBVi, CBXi) running firmware 9.3.4 and prior are affected; exploitation requires network access to the segment where FLXEON is installed. ↗

CVSS provenance

nvdv3.19.4CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.