CVE-2024-29666
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The Vehicle Monitoring platform CMSV6 uses default passwords that allow anyone with network access to gain unauthorized admin privileges. This is critical because attackers can take full control of the system without needing legitimate credentials.
An unauthenticated remote attacker can escalate privileges by exploiting default credentials in CMSV6 versions 7.31.0.2 through 7.32.0.3. The vulnerability stems from insecure permission configuration allowing default password authentication; successful exploitation grants full system access and control over vehicle monitoring functionality.