CVE-2024-24720: Innovaphone PBX · Information Exposure
Source CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 27 Feb 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, European organizations should first verify if their Innovaphone PBX devices are running versions prior to 14r1 and plan an upgrade to version 14r1 or later where this issue is presumably resolved. In the absence of an official patch, organizations can implement the following practical measures: 1) Restrict access to the Forgot Password function by limiting it to trusted networks or VPNs to reduce exposure to external attackers. 2) Implement rate limiting and monitoring on the password recovery endpoint to detect and block automated user enumeration attempts. 3) Customize or harden the Forgot Password workflow to provide generic responses that do not reveal user existence information, if the system allows configuration. 4) Enhance logging and alerting on authentication and password recovery requests to identify suspicious activity early. 5) Conduct user awareness training to mitigate risks from phishing or social engineering that could leverage leaked user information. 6) Review and enforce strong password policies and multi-factor authentication (MFA) on PBX user accounts to reduce the risk of credential compromise following user enumeration.
Description
An issue was discovered in the Forgot password function in Innovaphone PBX before 14r1 devices. It provides information about whether a user exists on a system.