CVE-2024-2389: Progress Flowmon management interface OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable OS command injection with CVSS 9.8 and very high EPSS makes this an urgent patch-first issue despite no KEV listing.

What it is

Flowmon versions prior to 11.1.14 and 12.3.5 contain an OS command injection flaw (CWE-78) in the management interface. An unauthenticated attacker can reach the interface and execute arbitrary system commands, making this a critical pre-auth remote code execution issue for exposed deployments.

Impact

An attacker gains arbitrary command execution on the Flowmon appliance with the privileges of the affected service, enabling full compromise of the system and any data or network visibility it holds.

Attack surface

Reachable over the network through the Flowmon management interface (CVSS AV:N, PR:N, UI:N), requiring no authentication and no user interaction. Any internet- or network-exposed management interface is directly at risk.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.93037, 99.8th percentile), indicating strong likelihood of exploitation activity; references are limited to vendor advisory and product pages.

What to do

• Upgrade Flowmon to 11.1.14 or 12.3.5 (or later) as the primary fix.
• Restrict access to the Flowmon management interface to trusted management networks or VPN; do not expose it to the internet.
• Place the management interface behind a firewall or reverse proxy with strict allowlisting.
• Monitor and review logs for unexpected command execution or anomalous management-interface requests.
• If immediate patching is not possible, isolate affected appliances on a segmented network.

Detection

• Review Flowmon management interface and web server logs for suspicious or malformed requests preceding command execution.
• Monitor for unexpected child processes spawned by the Flowmon web/management service (e.g., shell or system utilities).
• Alert on outbound connections from Flowmon appliances to unfamiliar hosts, which may indicate post-exploitation activity.
• Audit authentication and access logs for unauthenticated access attempts to the management interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.