The vulnerability identified as CVE-2024-54295 affects FluxBuilder's ListApp Mobile Manager up to version 1.7.7. It allows an attacker to bypass authentication mechanisms by exploiting an alternate path or channel within the application. This bypass can grant unauthorized access without credentials, resulting in complete compromise of the system's confidentiality, integrity, and availability. The CVSS 3.1 base score of 9.8 reflects the critical nature of this vulnerability, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed but lacks vendor-provided patch or mitigation details at this time.

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass authentication controls, potentially gaining full administrative access to the ListApp Mobile Manager. This can lead to unauthorized data access, modification, or deletion, and disruption of service. Given the critical CVSS score and full impact on confidentiality, integrity, and availability, the vulnerability poses a severe risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the ListApp Mobile Manager interface to trusted networks and users only. Monitor for any updates from FluxBuilder regarding patches or official mitigations. Avoid exposing the vulnerable service to untrusted networks.