by Kastro
Paper/Archive/CVE-2024-36439

CVE-2024-36439

swissphone dical-red_4009 — Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's ha…

EPSS 0.9%public exploitCVSS 9.4
critical.is priorityof 100
50
CVSS 9.4 (ADP)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 59.1.591 × 2011.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash value, without knowing the actual device password.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
dical-red_4009all versions–CISA-ADP

Scores by source

CISA ADP9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refswissphone.com/en-us/solutions/components/terminals/radio-data-module-dical-redrefsyss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-038.txtrefseclists.org/fulldisclosure/2024/Aug/32refseclists.org/fulldisclosure/2024/Aug/39refseclists.org/fulldisclosure/2024/Aug/40