CVE-2024-48932: IceWhaleTech ZimaOS · Improper Access Control
Affects IceWhaleTech ZimaOSSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium : upgrade to 1.5.0 when convenient.
Data as of 26 Oct 2026, 09:08 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 43% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 1.5.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 24 Oct 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade icewhaletech/ZimaOS to 1.5.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubicewhaletech/ZimaOSpkg:github/icewhaletech/ZimaOSOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Since no official patches are available, European organizations should implement immediate compensating controls. These include restricting network access to the vulnerable API endpoint via firewall rules or network segmentation to limit exposure to trusted users only. Deploying Web Application Firewalls (WAFs) with custom rules to block unauthenticated requests to /v1/users/name can reduce attack surface. Monitoring and logging access to this endpoint will help detect enumeration attempts early. Organizations should enforce strong authentication and multi-factor authentication (MFA) on all user accounts to mitigate risks from credential guessing attacks. Usernames should be treated as sensitive information internally, and security awareness training should be conducted to reduce phishing susceptibility. Finally, consider deploying intrusion detection systems (IDS) tuned to detect enumeration patterns against this API.
Description
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint `http://<Server-ip>/v1/users/name` allows unauthenticated users to access sensitive information, such as usernames, without any authorization. This vulnerability could be exploited by an attacker to enumerate usernames and leverage them for further attacks, such as brute-force or phishing campaigns. As of time of publication, no known patched versions are available.