CVE-2024-29082

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-29082
Improper access control vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to bypass authentication and factory reset the device via unprotected goform endpoints.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:vonets:var1200-h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:var1200-h:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:vonets:var1200-l_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:var1200-l:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:vonets:var600-h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:var600-h:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:vonets:vap11ac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11ac:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:vonets:vap11g-500s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11g-500s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:vonets:vbg1200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vbg1200:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:vonets:vap11s-5g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11s-5g:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:vonets:vap11s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11s:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:vonets:var11n-300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:var11n-300:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:vonets:vap11g-300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11g-300:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11n-300:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:vonets:vap11g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11g:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:vonets:vap11g-500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11g-500:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:vonets:vga-1000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vga-1000:-:*:*:*:*:*:*:*
History

20 Aug 2024, 17:11

Type Values Removed Values Added
First Time Vonets vga-1000
Vonets vga-1000 Firmware
Vonets vap11g
Vonets vap11ac Firmware
Vonets var1200-l
Vonets vbg1200
Vonets var600-h Firmware
Vonets vap11s-5g
Vonets vap11n-300
Vonets vap11g-500s
Vonets vap11ac
Vonets vap11n-300 Firmware
Vonets vbg1200 Firmware
Vonets var600-h
Vonets vap11g-300 Firmware
Vonets vap11g-500
Vonets vap11g-500s Firmware
Vonets var1200-h Firmware
Vonets vap11g-300
Vonets var1200-l Firmware
Vonets var1200-h
Vonets vap11g-500 Firmware
Vonets vap11s Firmware
Vonets
Vonets vap11s-5g Firmware
Vonets var11n-300
Vonets vap11s
Vonets vap11g Firmware
Vonets var11n-300 Firmware
Summary
  • (es) Una vulnerabilidad de control de acceso inadecuado que afecta a los relés de puente wifi industriales y a los repetidores de puente wifi de Vonets, versiones de software 3.3.23.6.9 y anteriores, permite a un atacante remoto no autenticado evitar la autenticación y restablecer los valores de fábrica del dispositivo a través de endpoints goform desprotegidos.
CPE cpe:2.3:o:vonets:vap11s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11g:-:*:*:*:*:*:*:*
cpe:2.3:o:vonets:vap11s-5g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11ac:-:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11s-5g:-:*:*:*:*:*:*:*
cpe:2.3:o:vonets:var1200-h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:vonets:vbg1200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:vonets:vap11g-300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vbg1200:-:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11n-300:-:*:*:*:*:*:*:*
cpe:2.3:h:vonets:var1200-h:-:*:*:*:*:*:*:*
cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:vonets:vga-1000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11s:-:*:*:*:*:*:*:*
cpe:2.3:o:vonets:vap11g-500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:var11n-300:-:*:*:*:*:*:*:*
cpe:2.3:o:vonets:var1200-l_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11g-500s:-:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11g-300:-:*:*:*:*:*:*:*
cpe:2.3:h:vonets:var1200-l:-:*:*:*:*:*:*:*
cpe:2.3:o:vonets:vap11g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vap11g-500:-:*:*:*:*:*:*:*
cpe:2.3:o:vonets:vap11g-500s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:vga-1000:-:*:*:*:*:*:*:*
cpe:2.3:o:vonets:vap11ac_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:vonets:var11n-300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:vonets:var600-h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:vonets:var600-h:-:*:*:*:*:*:*:*
References () https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08 - () https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08 - Third Party Advisory, US Government Resource

12 Aug 2024, 13:41

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-12 13:38

Updated : 2024-08-20 17:11

NVD link : CVE-2024-29082

Mitre link : CVE-2024-29082

CVE.ORG link : CVE-2024-29082

JSON object : View

Products Affected

vonets

  • vap11g-500s_firmware
  • vga-1000_firmware
  • var1200-l_firmware
  • vap11g-500
  • vap11s_firmware
  • vap11n-300
  • vap11n-300_firmware
  • vap11s-5g
  • vap11g
  • vga-1000
  • var1200-h_firmware
  • vap11s
  • var1200-h
  • vap11g_firmware
  • vap11s-5g_firmware
  • vap11ac_firmware
  • vap11g-300
  • vbg1200
  • vap11g-500_firmware
  • vbg1200_firmware
  • vap11ac
  • var11n-300
  • vap11g-500s
  • var600-h_firmware
  • var600-h
  • var1200-l
  • vap11g-300_firmware
  • var11n-300_firmware
CWE
CWE-284

Improper Access Control