Paper/Archive/CVE-2024-10381

CVE-2024-10381

Matrix Comsec Matrix Door Controller Cosec Vega FAXQ — Authentication Bypass Vulnerability in Matrix Door Controller

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 58.7.587 × 2011.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

This vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management at the web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the vulnerable device. Successful exploitation of this vulnerability could allow remote attacker to gain unauthorized access and take complete control of the targeted device.

Affected

ProductAffectedFixed inSource

Matrix Door Controller Cosec Vega FAXQ<V2R17–CNA

matrix_door_controller_cosec_vega_faxq_firmware< v2r17v2r17CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CERT-In (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupcert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0328