Missing Authentication Vulnerability in MileSight DeviceHub
CVE-2024-36388

9.8CRITICAL

Key Information:

Vendor

Milesight

Status
Devicehub
Vendor
CVE Published:
2 June 2024

What is CVE-2024-36388?

A recently discovered vulnerability in MileSight DeviceHub reveals a crucial flaw characterized by missing authentication for critical functions, classified under CWE-305. This oversight could allow unauthorized individuals to gain access to sensitive operational functionalities within the product. As a result, the security and integrity of user data may be at significant risk, necessitating immediate action from users and administrators to mitigate potential exploitation. It is essential for affected users to update to the latest security patches and implement strict access controls to safeguard their systems.

Affected Version(s)

DeviceHub v3.0.1-r1 for Ubuntu 20.04

References

https://www.gov.il/en/Departments/faq/cve_advisories

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claroty Research – Team 82
.