nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of…
Priority LOW 15CWE-405Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00605 49th percentileScored 2026-11-07
Fix Fixed nGrinder (NAVER): 3.5.9
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA nGrinder (NAVER) Fixed in 3.5.9
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28214
- 2026-10-03 Alias added: GHSA-qq6m-6p3w-4j5w
References
Advisory 1
More NAVER Ngrinder vulnerabilities
- TI-2024-18782 Missing authorization in NAVER nGrinder CVSS 3.1MEDIUM 5.4
- TI-2024-18778 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
- TI-2024-18777 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
- TI-2024-18779 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
- TI-2024-18781 Missing authorization in NAVER nGrinder CVSS 3.1HIGH 7.5
- TI-2016-04378 Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2024-28214 · CVE Program
- CVE-2024-28214 · NVD
- FIRST EPSS
- GHSA-qq6m-6p3w-4j5w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences