Authorization Bypass Vulnerability in Quanta Computer's QOCA

CVE-2024-13040

What is CVE-2024-13040?

The QOCA from Quanta Computer is vulnerable to an authorization bypass through a user-controlled key parameter. This flaw enables remote attackers with standard privileges to exploit the vulnerability and gain unauthorized access to restricted features. By manipulating the user ID parameter, attackers can modify any user's account information and privileges, resulting in potential privilege escalation. Organizations utilizing the QOCA should evaluate their network security posture and implement controls to mitigate the risks associated with this vulnerability.

References