Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2024-46310

Critical

Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpoint

Published Jan 13, 2025 · Updated Jul 5, 2026

Key Facts

Patch in the next maintenance window
  • CVE-2024-46310 is a critical-severity vulnerability (CVSS 9.1 v3.1).
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 2.5% probability of exploitation in the next 30 days.
  • No fixed version is listed yet; check the vendor advisory for mitigations.
  • Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

CVSS v3.1

9.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS (30-day exploit likelihood)

2.5%

Higher than 84.3% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2024-46310 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpoint

Timeline

  1. Publicly disclosed

    Jan 13, 2025

  2. Last updated

    Jul 5, 2026

Weakness Type

  • CWE-281 Improper Preservation of Permissions

References

FAQ

Common Questions.

Is CVE-2024-46310 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo