CVE-2024-41688: high-severity vulnerability in SyroTech SY-GPON-1110-WDONT router
Cleartext Storage of Sensitive Information Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7epss 0.1%
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext credentials on the vulnerable system.
Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
SyroTech · SyroTech SY-GPON-1110-WDONT routerRelated CVEs — SyroTech SY-GPON-1110-WDONT router
In the same product, most dangerous first.
CVE-2024-41685MEDIUMCookie Without HTTPOnly Flag Set VulnerabilityEPSS 0.5%CVE-2024-41687HIGHCleartext Transmission of Sensitive Information VulnerabilityEPSS 0.3%CVE-2024-41692HIGHIncorrect Access Control VulnerabilityEPSS 0.3%CVE-2024-41684MEDIUMCookie Without Secure Flag Set VulnerabilityEPSS 0.2%CVE-2024-41686HIGHPassword Policy Bypass VulnerabilityEPSS 0.2%CVE-2024-41689MEDIUMHard-coded Credentials VulnerabilityEPSS 0.2%