Unencrypted Device Configuration Credentials Exposed in Flash Memory
CVE-2024-39278
4.6MEDIUM
Key Information:
- Vendor
- Hughes Network Systems
- Status
- Wl3000 Fusion Software
- Vendor
- CVE Published:
- 5 September 2024
Summary
Credentials to access device configuration information stored unencrypted in flash memory. These credentials would allow read-only access to network configuration information and terminal configuration data.
Affected Version(s)
WL3000 Fusion Software 0 < 2.7.0.10
References
CVSS V3.1
Score:
4.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Credit
An anonymous researcher reported these vulnerabilities to CISA.