CVE-2024-1301 is a critical SQL injection in Badger Meter Monitool, an industrial monitoring product, scored 9.8. Versions 4.6.3 and earlier are affected through the j_username login parameter. INCIBE-CERT lists 4.7 and later as the fixed release. Upgrade and keep the login page off the open internet.
What's affected
The record says Monitool 4.6.3 and earlier. The advisory from INCIBE-CERT, the Spanish national CERT, gives the same range and names 4.7 and later as the fix. It scores the issue critical at 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The weak point is the j_username parameter on the login. A remote attacker with no account can send a crafted value and, per the record, retrieve information stored in the database.
Monitool is used to watch metering and sensor data in water and utility settings. I found no statement in the advisory about which customers are affected, and I do not name any.
Weakness class: CWE-89. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a score of 9.8.
How to check if you're exposed
Open the Monitool web interface as an administrator and read the version in its About or system information page. 4.6.3 or earlier is in range.
Next find out how the login is exposed. From a trusted host outside your network, check whether the Monitool address answers:
curl -sI https://your-monitool-host/
Do this only against hosts you own. If it answers from the internet, treat the fix as urgent and add a network control in front of it.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Upgrade Badger Meter Monitool to 4.7 or later, using the vendor's instructions.
- Confirm the version after the upgrade.
- Put the web interface behind a VPN or an allow list if it is currently public.
- Review web and database logs for odd values in the login request around and after the March 2024 publication.
- Change database and service account credentials that the application could read, if you see signs of misuse.
Why it matters
SQL injection (CWE-89) in a login form is especially serious because no one is logged in yet. The input goes into a query that checks credentials, and without parameterised queries crafted text can change the query.
The record's KEV flag is false and I found no source reporting exploitation. The risk is the combination of no authentication, network reach and a database that holds operational data. For industrial monitoring, exposure to the internet is the first thing to remove.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2024-1301?
INCIBE-CERT says 4.7 and later.
Does the attacker need an account?
No. The vector shows no privileges required and the flaw is in the login parameter itself.
Sources
Last reviewed: 19 October 2026.
