CVE-2024-5952: medium-severity vulnerability in Deep Sea Electronics DSE855
Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.6%
Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23174.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Deep Sea Electronics · DSE855Related CVEs — Deep Sea Electronics DSE855
In the same product, most dangerous first.
CVE-2024-5947MEDIUMDeep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure VulnerabilityEPSS 2.4%CVE-2024-5950HIGHDeep Sea Electronics DSE855 Multipart Value Handling Stack-Based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-5948HIGHDeep Sea Electronics DSE855 Multipart Boundary Stack-Based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.1%CVE-2024-5951HIGHDeep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service VulnerabilityEPSS 0.8%CVE-2024-5949MEDIUMDeep Sea Electronics DSE855 Multipart Boundary Infinite Loop Denial-of-Service VulnerabilityEPSS 0.6%