by Kastro
Paper/Archive/CVE-2024-42001

CVE-2024-42001

Vonets VAR1200-H — Vonets WiFi Bridges Forced Browsing

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.5.525 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct request when another user has an active session.

Affected

ProductAffectedFixed inSource
VAR1200-H≤ 3.3.23.6.9–CNA
VAR1200-L≤ 3.3.23.6.9–CNA
VAR600-H≤ 3.3.23.6.9–CNA
VAP11AC≤ 3.3.23.6.9–CNA
VAP11G-500S≤ 3.3.23.6.9–CNA
VBG1200≤ 3.3.23.6.9–CNA
VAP11S-5G≤ 3.3.23.6.9–CNA
VAP11S≤ 3.3.23.6.9–CNA
VAR11N-300≤ 3.3.23.6.9–CNA
VAP11G-300≤ 3.3.23.6.9–CNA
VAP11N-300≤ 3.3.23.6.9–CNA
VAP11G≤ 3.3.23.6.9–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
icscert (CNA)6.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcisa.gov/news-events/ics-advisories/icsa-24-214-08