How severe is CVE-2024-6425?

CVE-2024-6425 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2024-6425 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-6425?

CVE-2024-6425 affects Mesbook. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-6425?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2024-6425 have an EU (EUVD) identifier?

Yes. CVE-2024-6425 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-47528.

When was CVE-2024-6425 published?

CVE-2024-6425 was published on 2024-07-01 and last updated on 2026-06-17.

CVE-2024-6425

CVE-2024-6425 is a critical-severity vulnerability in Mesbook with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-684.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
EPSS exploit prediction: 1% (42nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-47528
Weakness: CWE-684
Affected product: Mesbook
Published: 2024-07-01
Last modified: 2026-06-17

Description

Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=<RANDOMUSER>&Password=<PASSWORD>&ConfirmPassword=<PASSWORD-REPEAT>".

Frequently asked questions

What is CVE-2024-6425?: Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=<RANDOMUSER>&Password=<PASSWORD>&ConfirmPassword=<PASSWORD-REPEAT>".
How severe is CVE-2024-6425?: CVE-2024-6425 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2024-6425 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-6425?: CVE-2024-6425 affects Mesbook. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-6425?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-6425 have an EU (EUVD) identifier?: Yes. CVE-2024-6425 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-47528.
When was CVE-2024-6425 published?: CVE-2024-6425 was published on 2024-07-01 and last updated on 2026-06-17.

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook

Affected products (1)

cpe:2.3:a:mesbook:mesbook:20221021.03:*:*:*:*:*:*:*

More vulnerabilities in Mesbook

CVE-2024-6424 — Critical (CVSS 9.3): External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated…
CVE-2024-6426 — High (CVSS 8.1): Information exposure vulnerability in MESbook 20221021.03 version, the exploitation of which could allow a local…
CVE-2024-6427 — High (CVSS 7.5): Uncontrolled Resource Consumption vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can…

All CVEs affecting Mesbook →

Other CWE-684 vulnerabilities

CVE-2024-50357 — Critical (CVSS 9.8): FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in…
CVE-2023-24845 — Critical (CVSS 9.1): A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM…
CVE-2023-4258 — High (CVSS 8.6): In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be…
CVE-2025-66384 — High (CVSS 8.2): app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity,…
CVE-2025-58325 — High (CVSS 8.2): An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5…
CVE-2025-47227 — High (CVSS 7.5): In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset…

Browse all CWE-684 vulnerabilities →