--- title: "CVE-2024-50618: CVE Public Notification of Resolution | CIPPlanner" description: "CIPPlanner public notification of resolution for CVE-2024-50618 in CIPAce. Status: Remedied." image: https://www.cipplanner.com/hubfs/raw_assets/public/cipplanner-theme/images/og-default.png --- [![CIPPlanner](https://www.cipplanner.com/hs-fs/hubfs/raw_assets/public/cipplanner-theme/images/cipplanner-logo.png?width=180&height=36&name=cipplanner-logo.png)](https://www.cipplanner.com/home?hsLang=en) - Platform - Solutions - Who We Serve - Customers - [Contact](https://www.cipplanner.com/contact?hsLang=en) [Request a Demo](https://www.cipplanner.com/request-a-demo?hsLang=en) #### The Platform - [CIPAce Platform Overview](https://www.cipplanner.com/platform?hsLang=en) - [AI Core](https://www.cipplanner.com/platform/ai-core?hsLang=en) - [Integrations and APIs](https://www.cipplanner.com/platform/integrations?hsLang=en) - [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance?hsLang=en) Platform One metadata-driven, low-code platform underneath every solution, so adding a solution is a configuration, not a second system of record. [Explore the CIPAce platform ›](https://www.cipplanner.com/platform?hsLang=en) #### Plan and Deliver - [Capital Planning and Budgeting](https://www.cipplanner.com/solutions/capital-planning-and-budgeting?hsLang=en) - [Capital Program Lifecycle Management](https://www.cipplanner.com/solutions/capital-program-lifecycle-management?hsLang=en) - [Project Schedule and Resource Management](https://www.cipplanner.com/solutions/project-schedule-and-resource-management?hsLang=en) #### Operate and Maintain - [Enterprise Asset Management](https://www.cipplanner.com/solutions/enterprise-asset-management?hsLang=en) - [Inspection and Work Management](https://www.cipplanner.com/solutions/inspection-and-work-management?hsLang=en) - [Bridge Inspection and Asset Management](https://www.cipplanner.com/solutions/bridge-inspection-and-asset-management?hsLang=en) Lifecycle Condition data from operations feeds the next capital plan. Start where the pressure is and add the rest without a second implementation. [Talk to us about your program ›](https://www.cipplanner.com/request-a-demo?hsLang=en) #### Sectors - [Cities and Counties](https://www.cipplanner.com/who-we-serve/cities-and-counties?hsLang=en) - [Transportation and Aviation](https://www.cipplanner.com/who-we-serve/transportation?hsLang=en) - [Water and Utilities](https://www.cipplanner.com/who-we-serve/water-and-utilities?hsLang=en) - [Private Enterprise](https://www.cipplanner.com/who-we-serve/private-enterprise?hsLang=en) Qualification Every sector page carries the funding sources, reporting obligations, and approval chain that shape a capital program in that sector. Named agencies and their results are in Customers. [See customer results ›](https://www.cipplanner.com/customers?hsLang=en) #### Customer Stories - [Fairfax County, Virginia](https://www.cipplanner.com/customers/fairfax-county?hsLang=en) - [New York City Department of Transportation](https://www.cipplanner.com/customers/nycdot?hsLang=en) - [City of Baltimore](https://www.cipplanner.com/customers/city-of-baltimore?hsLang=en) - [San Antonio Water System](https://www.cipplanner.com/customers/saws?hsLang=en) - [Indianapolis Airport Authority](https://www.cipplanner.com/customers/iaa?hsLang=en) - [Veolia Water](https://www.cipplanner.com/customers/veolia?hsLang=en) #### More From Customers - [All Customer Stories](https://www.cipplanner.com/customers?hsLang=en) - [Case Studies on Request](https://www.cipplanner.com/customers#on-request) - [Ask for a Peer Reference](https://www.cipplanner.com/contact#form) Proof More than 250 billion dollars in capital projects and programs managed on CIPAce, across 24 U.S. states. [View all customer stories ›](https://www.cipplanner.com/customers?hsLang=en) [Platform](https://www.cipplanner.com/platform?hsLang=en) › [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance?hsLang=en) › CVE-2024-50618 Security Advisory · CVE Public Notification of Resolution # CVE-2024-50618: CVE Public Notification of Resolution Status: Remedied. Single-factor authentication in the Authentication component, before version 9.17. At CIPPlanner, the security of customer installations of CIPAce™ software and data is our top priority. Therefore, we would like to inform you that CIPPlanner has recently identified a security incident and taken measures to remedy the situation; an enterprise-wide resolution initiative, identified and tracked as “S10001”, in March 2025. By: Kenneth Price Published: December 24, 2025, 9:19 AM EST Last Modified: December 24, 2025, 9:19 AM EST ## Situational Summary The incident involved an unauthorized party compromising an inactive third-party vendor user account at one of our customers. An independent investigation concluded by both the CIPPlanner cybersecurity team and the client’s IT team found no evidence of significant operational impact or security breach. We attribute this desired outcome to: CIPPlanner’s established security protocols; implementation of daily operational best practices; CIPAce™ maintenance; and the diligence of our SuperAdmin users. In according with the “CIPPlanner Security Incident Response Operating Procedure”, the cybersecurity team identified and remedied the Common Vulnerability and Exposures (CVE) discussed below. ## Vulnerability Details A use of Single-factor Authentication vulnerability in Authentication component in CIPAce™ product of CIPPlanner Corporation before version 9.17 allows attackers to bypass protection mechanism. When the system is configured to allow login with internal accounts, an attacker can possibly obtain full authentication if the secret in a single-factor authentication scheme gets compromised. ## CVE Registration In 2024, CIPPlanner reported to U.S. Government funded MITRE four (4) information security vulnerabilities to MITRE; the latter identifying the vulnerability as CVE-2024-50618. Registration metadata are as follows: | Type | Insecure Permissions | | --- | --- | | CVSS Version | 4.0 | | Metric Score | 6.1 | | Vector | AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/SC:N/VI:L/SI:N/VA:L/SA:N/ | ## CVE Resolution The status of CIPPlanner resolution of CVE-2024-50618 is “Remedied”. Related activities are: - CIPPlanner developed and distributed software patches to its valued customers. These resolutions are now embedded in later versions of the CIPAce™ codebase. - CIPPlanner retained New Jersey based cybersecurity consultant, Entersoft US LLC, to execute independent SAST, DAST, and Penetration Testing services on CIPAce™ full stack. Entersoft has performed independent services and certified CIPAce™ software. The certification protocols required CIPPlanner to remedy security vulnerabilities that are now reflected in later version codebases. - Resolution of the CVE came in the form of multifactored authentication (MFA) based on SMS verification being implemented in CIPAce™. Subsequently, CIPPlanner’s Product and Implementation teams executed the above software resolutions by: - Merging needed software remedies in new versions of CIPAce™ v10.x and beyond. - Distributing software patches and instructions to customers where no CIPAce™ upgrade is underway. - Code-merging software remedies into CIPAce™ as a part of ongoing software upgrade projects. If you have any questions or concerns, please do not hesitate to contact us. ## Footnote The mission of the CVE Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. The CVE program is maintained by the National Cybersecurity FFRDC (Federal Funded Research and Development Center), which is funded by the US Department of Homeland Security. For more information, please visit: - CVE Program Mission – [CVE Website](https://www.cve.org/) - CVE terminology – [Glossary | CVE](https://www.cve.org/ResourcesSupport/Glossary) - MITRE CVE Request form – [CVE – Common Vulnerabilities and Exposures (CVE)](https://cveform.mitre.org/) - CVSS – [Common Vulnerability Scoring System Version 4.0](https://www.first.org/cvss/v4-0/) ## Report a Security Concern The official record for this vulnerability is [CVE-2024-50618 at cve.org](https://www.cve.org/CVERecord?id=CVE-2024-50618). To report a suspected vulnerability or security event in CIPAce™, email [EventReport@cipplanner.com](mailto:EventReport@cipplanner.com). Our vulnerability management and disclosure practice is described on the [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance#advisories) page. ![CIPPlanner](https://www.cipplanner.com/hs-fs/hubfs/raw_assets/public/cipplanner-theme/images/cipplanner-logo-white.png?width=217&height=30&name=cipplanner-logo-white.png) For more than 25 years, CIPPlanner has delivered enterprise capital program management solutions to public sector infrastructure owners. CIPAce™ serves as the system of record for billion-dollar programs across city, county, state, utility, and transportation agencies in 24 U.S. states. [Request a Demo](https://www.cipplanner.com/request-a-demo?hsLang=en) #### Platform [CIPAce Platform Overview](https://www.cipplanner.com/platform?hsLang=en) [AI Core](https://www.cipplanner.com/platform/ai-core?hsLang=en) [Integrations and APIs](https://www.cipplanner.com/platform/integrations?hsLang=en) [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance?hsLang=en) #### Solutions [Capital Planning and Budgeting](https://www.cipplanner.com/solutions/capital-planning-and-budgeting?hsLang=en) [Capital Program Lifecycle Management](https://www.cipplanner.com/solutions/capital-program-lifecycle-management?hsLang=en) [Project Schedule and Resource Management](https://www.cipplanner.com/solutions/project-schedule-and-resource-management?hsLang=en) [Enterprise Asset Management](https://www.cipplanner.com/solutions/enterprise-asset-management?hsLang=en) [Inspection and Work Management](https://www.cipplanner.com/solutions/inspection-and-work-management?hsLang=en) [Bridge Inspection and Asset Management](https://www.cipplanner.com/solutions/bridge-inspection-and-asset-management?hsLang=en) #### Who We Serve [Cities and Counties](https://www.cipplanner.com/who-we-serve/cities-and-counties?hsLang=en) [Transportation and Aviation](https://www.cipplanner.com/who-we-serve/transportation?hsLang=en) [Water and Utilities](https://www.cipplanner.com/who-we-serve/water-and-utilities?hsLang=en) [Private Enterprise](https://www.cipplanner.com/who-we-serve/private-enterprise?hsLang=en) #### Customers [All Customer Stories](https://www.cipplanner.com/customers?hsLang=en) [Fairfax County, Virginia](https://www.cipplanner.com/customers/fairfax-county?hsLang=en) [New York City Department of Transportation](https://www.cipplanner.com/customers/nycdot?hsLang=en) [City of Baltimore](https://www.cipplanner.com/customers/city-of-baltimore?hsLang=en) [San Antonio Water System](https://www.cipplanner.com/customers/saws?hsLang=en) [Indianapolis Airport Authority](https://www.cipplanner.com/customers/iaa?hsLang=en) [Veolia Water](https://www.cipplanner.com/customers/veolia?hsLang=en) [Case Studies on Request](https://www.cipplanner.com/customers#on-request) #### Company [Request a Demo](https://www.cipplanner.com/request-a-demo?hsLang=en) [Contact](https://www.cipplanner.com/contact?hsLang=en) © 2026 CIPPlanner Corporation. All rights reserved. [Privacy Policy](https://www.cipplanner.com/contact#privacy)[Cookie Policy](https://www.cipplanner.com/contact#cookies) [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance?hsLang=en) ```json { "@context" : "https://schema.org", "@id" : "https://www.cipplanner.com/#organization", "@type" : "Organization", "brand" : { "@type" : "Brand", "name" : "CIPAce" }, "description" : "For more than 25 years, CIPPlanner has delivered enterprise capital program management solutions to public sector infrastructure owners. CIPAce serves as the system of record for billion-dollar programs across city, county, state, utility, and transportation agencies in 24 U.S. states.", "name" : "CIPPlanner Corporation", "url" : "https://www.cipplanner.com" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://www.cipplanner.com/", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://www.cipplanner.com/platform", "name" : "Platform", "position" : 2 }, { "@type" : "ListItem", "item" : "https://www.cipplanner.com/platform/security-and-compliance", "name" : "Security and Compliance", "position" : 3 }, { "@type" : "ListItem", "item" : "https://www.cipplanner.com/cve-2024-50618-cve-public-notification-of-resolution", "name" : "CVE-2024-50618", "position" : 4 } ] } ```