Default Password Vulnerability in LAN Interface Could Allow Remote Reset of User Account

CVE-2024-6788

Summary

This vulnerability allows a remote unauthenticated attacker to leverage the firmware update feature on the LAN interface of the affected device. By exploiting this weakness, the attacker can reset the password for the predefined low-privileged user account 'user-app' to its default value. This flaw potentially grants unauthorized access to sensitive functionalities of the device, underlining the necessity for security measures and timely firmware updates.

References