CVE-2024-4232

This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext passwords on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.

CVSS v3 4.1 MEDIUM

4.1^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 3.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0158
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0158

Configurations

No configuration.

History

21 Nov 2024, 09:42

Type	Values Removed	Values Added
References	~~() https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0158 -~~	() https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0158 -

03 Jul 2024, 02:07

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.1

05 Jun 2024, 13:15

Type	Values Removed	Values Added
Summary		(es) Esta vulnerabilidad existe en Digisol Router (DG-GR1321: versión de hardware 3.7L; versión de firmware: v3.2.02) debido a la presencia de acceso al terminal raíz en una interfaz serie sin el control de acceso adecuado. Un atacante con acceso físico podría aprovechar esto identificando los pines UART y accediendo al shell raíz del sistema vulnerable. La explotación exitosa de esta vulnerabilidad podría permitir al atacante acceder a información confidencial en el sistema objetivo. Esta vulnerabilidad existe en Digisol Router (DG-GR1321: versión de hardware 3.7L; versión de firmware: v3.2.02) debido a la falta de cifrado o hash en almacenamiento de contraseñas dentro del firmware/base de datos del enrutador. Un atacante con acceso físico podría aprovechar esto extrayendo el firmware y aplicando ingeniería inversa a los datos binarios para acceder a las contraseñas de texto sin formato en el sistema vulnerable. La explotación exitosa de esta vulnerabilidad podría permitir al atacante obtener acceso no autorizado al sistema objetivo.
Summary	(en) This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by identifying UART pins and accessing the root shell on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to access the sensitive information on the targeted system.This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext passwords on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.	(en) This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext passwords on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.
CWE		CWE-256

14 May 2024, 15:43

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-05-14 15:43

Updated : 2024-11-21 09:42

NVD link : CVE-2024-4232

Mitre link : CVE-2024-4232

CVE.ORG link : CVE-2024-4232

JSON object : View

Products Affected

No product.

CWE

CWE-256

Plaintext Storage of a Password

4.1 /10