Vulnerability record/PUBLISHED/Published Jul 31, 2024 13:16:57 UTC

CVE-2024-31200

A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext when an administrative session is open in the browser.

Base score4.2/ 10

SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorPhysicalAV

Attack complexityHighAC

Privileges requiredNonePR

User interactionNoneUI

ScopeUnchangedS

Confidentiality impactHighC

Integrity impactNoneI

Availability impactNoneA

CVSS vector stringCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityNozomi

Last updatedJul 31, 2024 14:21:55 UTC

PublishedJul 31, 2024 13:16:57 UTC

ReservedMar 29, 2024 08:32:14 UTC

Credits

Diego Zaffaroni of Nozomi Networks found this bug during a security research activity.