CVE-2024-41692: high-severity vulnerability in SyroTech SY-GPON-1110-WDONT router
Incorrect Access Control Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A SyroTech router has an unprotected root terminal accessible via a physical serial port, allowing anyone with physical access to run commands as the administrator. This is a serious risk for anyone using this router at home or in a business.
CWE-1191 describes improper access control on initialization, maintenance, debug, or test interfaces. The SY-GPON-1110-WDONT exposes an unauthenticated root shell on its serial interface, enabling local privilege escalation via physical access without authentication. Successful exploitation grants arbitrary command execution with root privileges.
In the same product, most dangerous first.