CVE-2024-1255 is a medium severity information disclosure in sepidz SepidzDigitalMenu, up to version 7.1.0728.1, on the Waiters route. NVD scores it 5.3 and the record says exploit details are public. The vendor did not respond, so no fix is confirmed.
What's affected
The record names sepidz SepidzDigitalMenu, up to version 7.1.0728.1. The weak spot is the Waiters route, with the request to that route argument. The remote attack path and the public disclosure both come from the VulDB entry, number 252994, which the record paraphrases.
NVD scores it 5.3, which is Medium. The vector needs no login and no user action, but the impact is limited to some confidentiality loss.
No fixed version is stated and the record says the vendor did not respond. Ask the vendor for a patched release and restrict public access to that route.
Weakness class: CWE-200. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N and a score of 5.3.
How to check if you're exposed
Request the route named in the record, the Waiters route, from a test machine that is not logged in, and see whether it returns data. Do this only on systems you own.
If you are not sure whether the product is installed, search your server inventory and application list for its name, since small business software like this often sits on a single forgotten host.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Find every installation of sepidz SepidzDigitalMenu and record the version.
- Ask the vendor for a patched release and apply it as soon as it is available.
- Until a fix exists, limit who can reach the application, for example by placing it behind a VPN or an allow list, and block public access to the Waiters route.
- Watch web server logs for requests to the affected route and for new or changed files.
- Plan a move to a maintained product if the vendor does not respond.
Why it matters
Information disclosure (CWE-200) means a route returns data to callers who should not see it. The record places the fault at the the Waiters route route and gives no more detail.
The score is low because the vector shows limited confidentiality impact and no effect on integrity or availability. Even so, a list of staff names or roles helps an attacker plan phishing or guessing. The record says the vendor was contacted early and did not respond in any way.
Quick check
Is CVE-2024-1255 known to be exploited?
The KEV flag in the record is false. The record does say the exploit details have been disclosed publicly, so do not wait for exploitation reports before acting.
Where can I read the original report?
The record cites VulDB entry 252994 and an outside write up. I could not retrieve them, so check them yourself for the proof of concept level detail, which this post leaves out on purpose.
Sources
Last reviewed: 19 October 2026.
