CVE-2024-8888: falha crítica em CIRCUTOR Q-SMT
Insufficient Session Expiration vulnerability on CIRCUTOR Q-SMT
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 0.4%
An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
CIRCUTOR · CIRCUTOR Q-SMTCVEs relacionadas — CIRCUTOR Q-SMT
No mesmo produto, das mais perigosas para as menos.
CVE-2024-8887CRITICALAuthentication bypass vulnerability on CIRCUTOR Q-SMTEPSS 0.6%CVE-2024-8890HIGHInsertion of Sensitive Information Into Sent Data vulnerability on CIRCUTOR Q-SMTEPSS 0.4%CVE-2024-8891MEDIUMExposure of Private Personal Information to an Unauthorized Actor vulnerability on CIRCUTOR Q-SMTEPSS 0.3%