# CVE-2024-12924: Akınsoft QR Menü open redirect

Source: https://junglewise.ai/threats/cve-2024-12924-ak-nsoft-qr-menu-open-redirect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2024-12924 · Severity: medium · CVSS 6.3 · Published 2025-09-01

Akınsoft QR Menü, a digital menu platform for restaurants and cafes, contains a security flaw that allows attackers to redirect users to malicious websites. By tricking a customer or staff member into clicking a specially crafted link, an attacker can facilitate phishing attacks to steal credentials or distribute malware. This can lead to reputational damage and potential compromise of user accounts.

Technologies: [Akınsoft QR Menü](https://junglewise.ai/threats/technologies/qr-men). Vendors: [Akınsoft](https://junglewise.ai/threats/vendors/ak-nsoft).

## Quick answers

**Is CVE-2024-12924 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-12924 being exploited in the wild.

**How severe is CVE-2024-12924?** Medium severity, with a CVSS score of 6.3, published 1 September 2025.

**Which products and versions are affected?** Akınsoft QR Menü s1.05.05 to v1.05.12.

**Is there a fix for CVE-2024-12924?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-12924 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-12924?** Check whether you run Akınsoft QR Menü at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Open Redirect vulnerability (CWE-601) exists in Akınsoft QR Menü versions s1.05.05 through v1.05.12. The application fails to properly validate user-supplied input used in redirection targets, allowing a remote attacker to craft a URL that redirects victims to an arbitrary external domain. Exploitation requires minimal user interaction, typically via a phishing link. Successful exploitation can be used to conduct phishing campaigns, bypass security filters, or perform forceful browsing attacks. The issue is addressed in version v1.05.12.

## Affected products

- Akınsoft QR Menü s1.05.05 to v1.05.12

## Timeline

- 2025-09-01: disclosed
- 2025-09-01: advisory

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0202](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0202)
- [https://www.usom.gov.tr/bildirim/tr-25-0202](https://www.usom.gov.tr/bildirim/tr-25-0202)

## Related threats

- [Akınsoft QR Menü CSRF vulnerability](https://junglewise.ai/threats/cve-2025-0610-ak-nsoft-qr-menu-csrf-vulnerability)
- [Akınsoft QR Menü HTTP response splitting via certificate host mismatch](https://junglewise.ai/threats/cve-2024-12925-ak-nsoft-qr-menu-http-response-splitting-via-certificate-host)
- [Akınsoft QR Menü cross-site scripting](https://junglewise.ai/threats/cve-2024-12914-ak-nsoft-qr-menu-cross-site-scripting)