CVE-2024-25830
CWE-22Published: February 29, 2024· Updated: Jun 17, 2026
Official Description
F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A successful exploit could allow the attacker to extract the root and admin password.
Risk Analysis
F-logic DataCube3 suffers from an access control flaw that allows unauthenticated remote attackers to access configuration files and extract sensitive credentials like root and admin passwords. This critical vulnerability has a CVSS score of 9.8.
A proof-of-concept exploit is publicly available, though it is not currently in the CISA KEV catalog. It is remotely exploitable with low attack complexity.
Administrators should update the DataCube3 firmware to a version that restricts unauthorized access to configuration files.
Technical Analysis
CVE-2024-25830 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
A proof-of-concept (PoC) exploit exists for CVE-2024-25830. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (2)
Quick Facts
Related CVEs (CWE-22)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2024-25830 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts