CVE-2024-51558

Wave 2.0 application does not implement restrictions on the number of failed authentication attempts on its API interface (CWE-307: Improper Restriction of Excessive Authentication Attempts). A remote attacker can repeatedly send login requests, trying successive combinations of OTP, MPIN, or password, without risk of being blocked or having additional security measures triggered. After guessing the correct authentication credentials, the attacker gains unauthorized access to the victim's account.

An attacker can gain unauthorized access to user accounts and take full control over them. The consequence is a breach of confidentiality, integrity, and availability of data stored on compromised accounts.

Patches available from the vendor should be applied according to references. It is recommended to implement mechanisms limiting the number of login attempts (rate limiting, account lockout after a specified number of failed attempts) and monitoring of suspicious activity on the API interface.

63Moons Wave 2.0 and 63Moons Aero — specific versions indicated in vendor references