CVE-2024-2389 is a critical (10.0) OS command injection in Progress Flowmon. An unauthenticated user can run system commands through the management interface. Versions before 11.1.14 and 12.3.5 are affected. Upgrade to those releases or later. NVD published it on 2024-04-02. CISA does not list it as exploited.
Weakness: CWE-78 (OS Command Injection).
What's affected
- Affected: Flowmon versions prior to 11.1.14 (11.x line) and prior to 12.3.5 (12.x line).
- Fixed: 11.1.14 and 12.3.5, per the record.
- Attack conditions:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Network reachable, no privileges, no user interaction, and the scope is changed, which is how a 10.0 is reached.
The record says an unauthenticated user can gain entry via the Flowmon management interface and run arbitrary system commands. We could not read the vendor article, which redirected to a community page that did not load, so check it for further mitigation steps.
How to check if you're exposed
- Sign in to the Flowmon web interface and read the version from the about or system page.
- Confirm which network ranges can reach the management interface, for example from a test host with
curl -kI https://FLOWMON_HOST/. - Review the appliance and web server logs for unexpected requests to the management interface since March 2024.
If you track dependencies, the free in-browser dependency scan can show whether a library or package in your project matches a known CVE. It will not find a standalone PHP application or a firmware image that was never packaged as a dependency, so keep your own inventory of those.
What to do now
- Upgrade Flowmon to 11.1.14 or 12.3.5, or later releases, following Progress's instructions.
- Restrict the management interface to a dedicated administration network or VPN right away.
- Review the appliance for unexpected accounts, scheduled jobs and outbound connections.
- If the interface was exposed before upgrading, treat credentials and keys stored on the appliance as possibly compromised and rotate them.
- Check the vendor advisory for added mitigations.
Why it matters
The record classes this as CWE-78 (OS Command Injection). Command injection happens when input is passed to the operating system shell without being neutralized. When that input needs no login, anyone who can reach the interface can run commands as the web service, and on an appliance that watches network traffic, that is a strong position to be in.
NVD scored it 10.0 (Critical). The KEV flag is false and the record does not say it is exploited in the wild, but an unauthenticated 10.0 on a management page should be patched without waiting for that to change.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions fix CVE-2024-2389?
11.1.14 and 12.3.5, per the record.
Is this exploited in the wild?
The record's KEV flag is false and no source we read reports exploitation.
Sources
- CVE-2024-2389 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2389, as held in the batch record
- Progress vendor advisory (redirected, content did not load when we fetched it)
Last reviewed: 19 October 2026.
