CVE-2024-41197

CVE-2024-41197 is a critical authentication bypass and privilege escalation vulnerability affecting Ocuco Innovation's INVCLIENT.EXE v2.10.24.5. An unauthenticated attacker can exploit this flaw remotely by sending a specially crafted TCP packet, gaining Administrator privileges. This vulnerability carries a CVSS score of 9.8 (CRITICAL) due to its network attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community discussion, indicating awareness and potential interest from threat actors.