CVE-2024-8888 - An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4

CVE-2024-8888

Summary

An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products

Vulnerable Configurations

cpe:2.3:o:circutor:q-smt_firmware:1.0.4:*:*:*:*:*:*:*
cpe:2.3:o:circutor:q-smt_firmware:1.0.4:*:*:*:*:*:*:*
cpe:2.3:h:circutor:q-smt:-:*:*:*:*:*:*:*
cpe:2.3:h:circutor:q-smt:-:*:*:*:*:*:*:*

CVSS

Base:	None
Impact:
Exploitability:

CWE

CWE-613

CAPEC

Access

Vector	Complexity	Authentication

Impact

Confidentiality	Integrity	Availability

Last major update

01-10-2024 - 19:30

Published

18-09-2024 - 12:15

Last modified

01-10-2024 - 19:30