How severe is CVE-2024-51557?

CVE-2024-51557 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-51557 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-51557?

CVE-2024-51557 primarily affects 63moons Aero. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-51557?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-51557 have an EU (EUVD) identifier?

Yes. CVE-2024-51557 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-45395.

When was CVE-2024-51557 published?

CVE-2024-51557 was published on 2024-11-04 and last updated on 2026-06-17.

CVE-2024-51557

CVE-2024-51557 is a medium-severity vulnerability in 63moons Aero with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-770.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v4: 7.1
EPSS exploit prediction: 0% (36th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-45395
Weakness: CWE-770
Affected product: 63moons Aero
Published: 2024-11-04
Last modified: 2026-06-17

Description

This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.

Frequently asked questions

What is CVE-2024-51557?: This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.
How severe is CVE-2024-51557?: CVE-2024-51557 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-51557 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-51557?: CVE-2024-51557 primarily affects 63moons Aero. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-51557?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-51557 have an EU (EUVD) identifier?: Yes. CVE-2024-51557 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-45395.
When was CVE-2024-51557 published?: CVE-2024-51557 was published on 2024-11-04 and last updated on 2026-06-17.

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332

Affected products (2)

cpe:2.3:a:63moons:aero:*:*:*:*:*:*:*:*
cpe:2.3:a:63moons:wave_2.0:*:*:*:*:*:*:*:*

More vulnerabilities in 63moons Aero

CVE-2024-51558 — Critical (CVSS 9.8): This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on…
CVE-2024-51561 — High (CVSS 7.5): This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints.…
CVE-2024-51559 — Medium (CVSS 6.5): This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An…
CVE-2024-51556 — Medium (CVSS 6.5): This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API…
CVE-2024-51560 — Medium (CVSS 4.3): This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API…

All CVEs affecting 63moons Aero →

Other CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerabilities

CVE-2026-31283 — Critical (CVSS 9.8): In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email…
CVE-2020-37067 — Critical (CVSS 9.8): Filetto 1.0 FTP server contains a denial of service vulnerability in the FEAT command processing that allows attackers…
CVE-2021-47875 — Critical (CVSS 9.8): GeoGebra CAS Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the…
CVE-2025-11832 — Critical (CVSS 9.8): Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access…
CVE-2024-44241 — Critical (CVSS 9.8): The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia…
CVE-2022-3439 — Critical (CVSS 9.8): Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.

Browse all CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerabilities →