CVE-2024-6880

CVE-2024-6880 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-538.

Key facts

Description

During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as one of the protection mechanisms.  Publicly available source code of "/registered.php" discloses that path, allowing an attacker to attempt further attacks.   This issue affects MegaBIP software versions below 5.15

Frequently asked questions

What is CVE-2024-6880?
During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as one of the protection mechanisms.  Publicly available source code of "/registered.php" discloses that path, allowing an attacker to attempt further attacks.   This issue affects MegaBIP software versions below 5.15
How severe is CVE-2024-6880?
CVE-2024-6880 has a CVSS 4.0 base score of 6.9, rated medium severity.
Is CVE-2024-6880 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (38th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-6880?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-6880 have an EU (EUVD) identifier?
Yes. CVE-2024-6880 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-48014.
When was CVE-2024-6880 published?
CVE-2024-6880 was published on 2025-01-10 and last updated on 2026-06-17.

References

Other CWE-538 vulnerabilities

Browse all CWE-538 vulnerabilities →