Unencrypted Device Configuration Credentials Exposed in Flash Memory
CVE-2024-39278
4.2MEDIUM
Key Information
- Vendor
- Hughes Network Systems
- Status
- Wl3000 Fusion Software
- Vendor
- CVE Published:
- 5 September 2024
Summary
Credentials to access device configuration information stored unencrypted in flash memory. These credentials would allow read-only access to network configuration information and terminal configuration data.
Affected Version(s)
WL3000 Fusion Software < 2.7.0.10
CVSS V3.1
Score:
4.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Physical
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Risk change from: null to: 4.2 - (MEDIUM)
Vulnerability published.
Collectors
NVD DatabaseMitre Database
Credit
An anonymous researcher reported these vulnerabilities to CISA.