Default Password Vulnerability in LAN Interface Could Allow Remote Reset of User Account
CVE-2024-6788
8.6HIGH
What is CVE-2024-6788?
This vulnerability allows a remote unauthenticated attacker to leverage the firmware update feature on the LAN interface of the affected device. By exploiting this weakness, the attacker can reset the password for the predefined low-privileged user account 'user-app' to its default value. This flaw potentially grants unauthorized access to sensitive functionalities of the device, underlining the necessity for security measures and timely firmware updates.
Affected Version(s)
CHARX SEC-3000 0 < 1.6.3
CHARX SEC-3050 0 < 1.6.3
CHARX SEC-3100 0 < 1.6.3
References
CVSS V3.1
Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
McCaulay Hudson
Alexander Plaskett
NCC Group