CVE-2024-0390mediumCWE-798

CVE-2024-0390: medium-severity vulnerability in INPRAX iZZi connect

Hard-coded credentials in iZZi connect application

Published · Updated

Follow this CVE+ Monitor iZZi connect

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.2epss 0.4%
INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access to manage and read parameters of the recuperation unit "reQnet iZZi".This issue affects "iZZi connect" application versions before 2024010401.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
INPRAX · iZZi connect