Insufficiently Random Values May Bypass Authentication
CVE-2024-36389

9.8CRITICAL

Key Information:

Vendor

Milesight

Status
Devicehub
Vendor
CVE Published:
2 June 2024

What is CVE-2024-36389?

An authentication bypass vulnerability exists in MileSight DeviceHub, attributed to the use of insufficiently random values. This weakness can enable unauthorized users to gain access to sensitive functionalities and data within the affected systems. As a result, it poses significant risks to organizational cybersecurity and data integrity. Organizations using MileSight DeviceHub are urged to conduct immediate assessments and adopt appropriate mitigations to safeguard their environments.

Affected Version(s)

DeviceHub v3.0.1-r1 for Ubuntu 20.04

References

https://www.gov.il/en/Departments/faq/cve_advisories

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claroty Research – Team 82
.