by Kastro
Paper/Archive/CVE-2024-0390

CVE-2024-0390

INPRAX iZZi connect — Hard-coded credentials in iZZi connect application

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 38.7.387 × 207.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access to manage and read parameters of the recuperation unit "reQnet iZZi".This issue affects "iZZi connect" application versions before 2024010401.

Affected

ProductAffectedFixed inSource
iZZi connect< 20240104012024010401CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeupcert.pl/en/posts/2024/02/CVE-2024-0390writeupcert.pl/posts/2024/02/CVE-2024-0390