CVE-2024-8888: fallo crítico en CIRCUTOR Q-SMT
Insufficient Session Expiration vulnerability on CIRCUTOR Q-SMT
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 10epss 0.4%
An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Productos afectados
CIRCUTOR · CIRCUTOR Q-SMTCVEs relacionadas — CIRCUTOR Q-SMT
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-8887CRITICALAuthentication bypass vulnerability on CIRCUTOR Q-SMTEPSS 0.6%CVE-2024-8890HIGHInsertion of Sensitive Information Into Sent Data vulnerability on CIRCUTOR Q-SMTEPSS 0.4%CVE-2024-8891MEDIUMExposure of Private Personal Information to an Unauthorized Actor vulnerability on CIRCUTOR Q-SMTEPSS 0.3%