CVE-2024-0358 is a medium severity improper access control vulnerability in DeShang DSO2O up to 4.1.0, scored CVSS 5.3. It affects /install/install.php through the installer script. The record names no fixed version, so check the vendor or project and restrict access.
What's affected
The record names DeShang DSO2O, up to 4.1.0. The weakness is improper access control on an installer script, a file meant to be used once during setup that stays reachable on the live site. The weakness is tracked as CWE-284. The affected code is /install/install.php, reached through the installer script. The record says the issue can be reached remotely and that an exploit has been disclosed publicly. It was published on 2024-01-10 and the VulDB identifier is 250125.
The record links a researcher's write up, but we could not read it in usable form, and the VulDB entry is behind a bot check, so we cannot add details beyond the record.
The record does not name a fixed version. Treat the product as unpatched until the vendor or project says otherwise. It is not on the CISA Known Exploited Vulnerabilities list, and the sources we read do not report exploitation.
How to check if you're exposed
The question is simple: does the installer still exist on the live site? Check for it in the web root:
ls -l /install/install.php
If the file is there and reachable by URL, treat the site as exposed. Installers often check for a lock file or a configuration file and refuse to run again. The record says improper access controls apply, so do not assume that check holds in your copy.
Also look at your access logs for requests to the installer path from addresses you do not know. A site that has been running for months should see none. If you find hits, check whether the configuration or the database changed around the same time.
A dependency scanner will not find a standalone application like this on its own, because it is deployed code, not a package. You can still use Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan on any project that bundles it as a library, and the Gold entry for CVE-2024-0358 tracks the record as it changes.
What to do now
- Find every deployed copy of DSO2O, including test and staging servers.
- Delete the installer file, or the whole install folder, from any live site. A finished installation does not need it.
- If you cannot delete it, block the path at the web server so only trusted addresses can reach it.
- Confirm the site still works after the change, and keep the installer in your deployment source, not on the server.
- Review configuration and database content for changes you did not make.
- Check the vendor or project page for a fixed release. We could not confirm one.
- Add a check to your release process that fails when an install path is present in production.
Why it matters
Installers are written to run once. Left on a live site they can be reached by anyone, and a weak check turns a setup screen into a way to change the site. The class is improper access control, and the fix is operational as much as it is code: remove the file once setup is done.
The record's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, scored 5.3 (medium). The VulDB wording calls the issue problematic, while the record's description of the product family shows several sibling products from the same vendor with the same file path. If you run more than one product from one vendor, check each of them.
This record is not on the CISA Known Exploited Vulnerabilities list. The description does say the exploit has been disclosed to the public and may be used, which means the technical detail is available to anyone who looks. That is a reason to act on exposed copies even though no exploitation is recorded in the sources we could read.
Quick check
Is CVE-2024-0358 known to be exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list and the sources we could read do not report exploitation. The description says a public exploit exists, so do not wait for confirmation.
Is there a fixed version of DSO2O?
The record does not name one. Check the vendor or project, and if none exists, restrict access or retire the software.
Sources
- Gold entry for CVE-2024-0358
- NVD record for CVE-2024-0358, including VulDB entry 250125, as summarized in the Safeguard record file. We could not load the VulDB page or the linked researcher write up, so details beyond the record are not confirmed.
Last reviewed: 19 October 2026.
