CVE-2024-0302 is a medium severity (CVSS 6.3) insecure deserialization weakness in fhs-opensource iparking. No fixed version is confirmed in the record, so check the vendor or project page. The record says an exploit has been disclosed to the public. It is not listed as exploited in the wild by CISA.
What's affected
iparking 1.5.22.RELEASE from fhs-opensource. The affected path is /vueLogin.
The weakness is mapped to CWE-502, deserialization of untrusted data. The record was published on 2024-01-08. The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog.
The sources disagree on severity. The description, which comes from VulDB, calls the issue critical. NVD's CVSS 3.1 score is 6.3, which is Medium, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Both ratings are published. Plan around the rating that matches your exposure: an internet facing copy deserves the more urgent reading.
How to check if you're exposed
This is software you install yourself or an appliance, so start from your own inventory. Find where the product runs, read its version from the application, its package metadata or its install directory, and compare it to the range above.
grep -ril "'+d['short'].split('-')[0]+'" /var/www 2>/dev/null
That searches a typical web root for the product name, so adjust the path to your server. For code you maintain, search for the file and parameter named in the record and read how the value is used.
You can also paste a manifest or SBOM into the free in-browser scanner at Safeguard Gold to see which known CVEs apply to your dependencies. It only covers components that appear in a manifest or SBOM, so a standalone appliance still needs the manual check.
What to do now
- Find every deployment of fhs-opensource iparking in your environment, including test systems and anything bought or installed by a team outside IT.
- Check the vendor or project page for a fixed release. None is confirmed in the record, so do not assume that upgrading to the latest version resolves it until the notes say so.
- Restrict network access to the login path to the users who need it.
- Review the dependencies on the application classpath, since deserialization risk depends on which libraries are present.
- Replace native object deserialization with a plain data format when you control the code.
- Re-run a scan after the change and record the date, so you can show the exposure is closed.
Why it matters
Deserialization flaws arise when an application rebuilds objects from data that a caller controls. If the classes available to the application can be abused while objects are rebuilt, the result can be code execution or other unintended behaviour.
The safer pattern is to avoid native object deserialization for untrusted input, use a plain data format such as JSON with a schema, and restrict which classes may be loaded when deserialization is unavoidable.
The CVSS vector reads as follows. The attack is possible over the network, attack complexity is low, privileges required are low, and user interaction is not needed. The impact on confidentiality, integrity and availability is limited, limited and limited respectively. A score is a starting point. Your own exposure, meaning whether the product faces the internet and what it can reach, decides the real priority.
Quick check
Is this vulnerability known to be exploited in the wild?
The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog. The description says an exploit has been disclosed to the public, which is not the same as confirmed attacks. Treat the public disclosure as a reason to act sooner.
Which versions are fixed?
The record does not confirm a fixed version, and the vendor reference could not be retrieved. Check the vendor or project page, and if none is available, restrict access to the product or replace it.
Sources
The vendor and researcher references listed in the NVD record could not be retrieved when this post was written, so the details above come from the NVD record itself.
Last reviewed: 19 October 2026.
