CVE-2024-55160 is a SQL injection vulnerability affecting GFast software versions from v2 through v3.2. The flaw is exploitable via the OrderBy parameter in the /system/operLog/list endpoint, allowing remote attackers to inject malicious SQL queries without authentication. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. No official patch or remediation guidance has been published yet, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized data access, data modification, or deletion, and potentially full system compromise. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and monitor for unusual activity related to the /system/operLog/list endpoint. Avoid exposing the vulnerable versions to untrusted networks. Follow vendor updates closely for patches or official mitigations.