CVE-2024-49383

The acep-importer service listens on all network interfaces instead of just localhost, allowing anyone on the network to potentially access it. This unnecessarily exposes the service to attacks that could otherwise be prevented by limiting who can connect.

The acep-importer service binds to an unrestricted IP address (0.0.0.0), expanding the attack surface by exposing the service to unauthenticated network access. This configuration increases the potential for network-based exploitation and abuse, particularly in multi-tenant or untrusted network environments. Mitigation requires binding to restricted IP addresses or implementing network segmentation controls.