Medium severity · published Jan 31, 2024
CVE-2024-23637
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other…
4.9
CVSS
0.5%
EPSS
No
On KEV
Description
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Octoprint · Octoprint
through 1.9.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23637
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23637
Patch
https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125
Release Notes
https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1
Third Party Advisory
https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr
More from Octoprint
9.4
CVE-2024-32977
OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled
9.1
CVE-2018-16710
OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081
8.8
CVE-2025-58180
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
8.8
CVE-2022-3068
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3
7.8
CVE-2022-2930
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3