{"id":64353,"date":"2025-08-27T12:38:54","date_gmt":"2025-08-27T12:38:54","guid":{"rendered":""},"modified":"2025-09-10T13:07:59","modified_gmt":"2025-09-10T19:07:59","slug":"cve-2024-57155-a-critical-access-control-vulnerability-in-radar-v1-0-8","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2024-57155-a-critical-access-control-vulnerability-in-radar-v1-0-8\/","title":{"rendered":"<strong>CVE-2024-57155: A Critical Access Control Vulnerability in Radar v1.0.8<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>The cybersecurity world is abuzz with the discovery of a new critical vulnerability, CVE-2024-57155, that impacts the Radar v1.0.8 software. This vulnerability, characterized by incorrect access control, allows malicious actors to bypass authentication mechanisms to gain unauthorized access to sensitive APIs, creating an avenue for potential system compromise or data leakage. This <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-20217-denial-of-service-vulnerability-in-snort-3-detection-engine-of-cisco-secure-firewall-threat-defense-software\/\"  data-wpil-monitor-id=\"76963\">vulnerability is therefore a significant threat<\/a> to any organization, large or small, that uses the Radar v1.0.8 software. It is <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-43275-critical-race-condition-vulnerability-in-macos\/\"  data-wpil-monitor-id=\"71627\">critical to understand the nature of this vulnerability<\/a> and adopt appropriate measures for mitigation to safeguard sensitive data and systems.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2024-57155<br \/>\nSeverity: Critical (9.8 CVSS Severity Score)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: None<br \/>\nImpact: Unauthorized access to sensitive APIs, <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-49691-heap-based-buffer-overflow-in-windows-media-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"72224\">leading to potential system<\/a> compromise or data leakage.<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-269734930\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>Radar | v1.0.8<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The exploit takes advantage of incorrect <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-52289-broken-access-control-vulnerability-in-magnusbilling-v7-8-5-3\/\"  data-wpil-monitor-id=\"73344\">access controls<\/a> in Radar v1.0.8. An attacker can send a specially crafted request to the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-27046-critical-memory-corruption-vulnerability-threatening-system-integrity\/\"  data-wpil-monitor-id=\"75031\">vulnerable system<\/a>, which lacks the appropriate checks to verify the authentication status of users. As a result, the attacker can bypass authentication and gain <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-53495-unauthorized-access-data-leakage-in-wikimedia-foundation-mediawiki-abusefilter-extension\/\"  data-wpil-monitor-id=\"72469\">unauthorized access<\/a> to sensitive APIs. This could <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-27055-memory-corruption-leads-to-potential-system-compromise-during-image-encoding\/\"  data-wpil-monitor-id=\"74330\">potentially result in system compromise<\/a> or data leakage.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-777615308\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>Here is a conceptual example of how the vulnerability might be exploited. An <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2024-9408-server-side-request-forgery-attack-in-eclipse-glassfish\/\"  data-wpil-monitor-id=\"77289\">attacker might send a HTTP request<\/a> similar to the following:<\/p>\n<pre><code class=\"\" data-line=\"\">GET \/api\/sensitive_endpoint HTTP\/1.1\nHost: target.example.com<\/code><\/pre>\n<p>In this case, the request is made without any <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-55306-critical-api-key-and-authentication-token-exposure-in-genx-fx-trading-platform\/\"  data-wpil-monitor-id=\"81362\">authentication token<\/a>. However, <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-8028-critical-vulnerability-in-firefox-and-thunderbird-due-to-incorrect-computation-of-branch-address\/\"  data-wpil-monitor-id=\"73786\">due to incorrect<\/a> access control in Radar v1.0.8, the system fails to authenticate the request properly, allowing the attacker to access sensitive APIs without a token.<\/p>\n<p><strong>Mitigation Guidance<\/strong><\/p>\n<p>To mitigate the risk posed by CVE-2024-57155, it is advised to apply the patch provided by the vendor for Radar v1.0.8. In the absence of a patch, or as a temporary measure, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used to detect and <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-8059-critical-privilege-escalation-vulnerability-in-b-blocks-wordpress-plugin\/\"  data-wpil-monitor-id=\"76325\">block attempts to exploit this vulnerability<\/a>. Regular monitoring and updating of security systems can also go a long way in preventing breaches stemming from this vulnerability.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview The cybersecurity world is abuzz with the discovery of a new critical vulnerability, CVE-2024-57155, that impacts the Radar v1.0.8 software. This vulnerability, characterized by incorrect access control, allows malicious actors to bypass authentication mechanisms to gain unauthorized access to sensitive APIs, creating an avenue for potential system compromise or data leakage. This vulnerability is [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[75],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-64353","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-authentication-bypass"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/64353","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=64353"}],"version-history":[{"count":11,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/64353\/revisions"}],"predecessor-version":[{"id":73811,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/64353\/revisions\/73811"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=64353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=64353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=64353"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=64353"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=64353"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=64353"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=64353"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=64353"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=64353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}