Details of VAR-202407-2574

ID

VAR-202407-2574

CVE

CVE-2024-41691

TITLE

syrotech of sy-gpon-1110-wdont Vulnerability related to plaintext storage of important information in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-004959

DESCRIPTION

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext FTP credentials from the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the FTP server associated with the targeted system. SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech

Trust: 2.16

sources: NVD: CVE-2024-41691 // JVNDB: JVNDB-2024-004959 // CNVD: CNVD-2024-34371

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-34371

AFFECTED PRODUCTS

vendor:	syrotech	model:	sy-gpon-1110-wdont	scope:	-	version:	-	Trust: 1.4
vendor:	syrotech	model:	sy-gpon-1110-wdont	scope:	eq	version:	3.1.02-231102	Trust: 1.0
vendor:	syrotech	model:	sy-gpon-1110-wdont	scope:	eq	version:	sy-gpon-1110-wdont firmware 3.1.02-231102	Trust: 0.8
vendor:	syrotech	model:	sy-gpon-1110-wdont	scope:	eq	version:	-	Trust: 0.8

sources: CNVD: CNVD-2024-34371 // JVNDB: JVNDB-2024-004959 // NVD: CVE-2024-41691

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2024-41691
value:	MEDIUM
Trust: 1.0
vdisclose@cert-in.org.in:	CVE-2024-41691
value:	HIGH
Trust: 1.0
NVD:	CVE-2024-41691
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2024-34371
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2024-34371
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2024-41691
baseSeverity:	MEDIUM
baseScore:	4.6
vectorString:	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	0.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2024-41691
baseSeverity:	MEDIUM
baseScore:	4.6
vectorString:	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2024-34371 // JVNDB: JVNDB-2024-004959 // NVD: CVE-2024-41691 // NVD: CVE-2024-41691

PROBLEMTYPE DATA

problemtype:	CWE-312	Trust: 1.0
problemtype:	Plaintext storage of important information (CWE-312) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-004959 // NVD: CVE-2024-41691

PATCH

title:

Patch for SyroTech SY-GPON-1110-WDONT Information Disclosure Vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/575411

Trust: 0.6

sources: CNVD: CNVD-2024-34371

EXTERNAL IDS

db:	NVD	id:	CVE-2024-41691	Trust: 3.2
db:	JVNDB	id:	JVNDB-2024-004959	Trust: 0.8
db:	CNVD	id:	CNVD-2024-34371	Trust: 0.6

sources: CNVD: CNVD-2024-34371 // JVNDB: JVNDB-2024-004959 // NVD: CVE-2024-41691

REFERENCES

url:	https://www.cert-in.org.in/s2cmainservlet?pageid=pubvlnotes01&vlcode=civn-2024-0225	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2024-41691	Trust: 1.4

sources: CNVD: CNVD-2024-34371 // JVNDB: JVNDB-2024-004959 // NVD: CVE-2024-41691

SOURCES

db:	CNVD	id:	CNVD-2024-34371
db:	JVNDB	id:	JVNDB-2024-004959
db:	NVD	id:	CVE-2024-41691

LAST UPDATE DATE

2024-08-15T12:45:55.637000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2024-34371	date:	2024-08-02T00:00:00
db:	JVNDB	id:	JVNDB-2024-004959	date:	2024-08-07T01:01:00
db:	NVD	id:	CVE-2024-41691	date:	2024-08-05T21:06:25.923

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2024-34371	date:	2024-08-02T00:00:00
db:	JVNDB	id:	JVNDB-2024-004959	date:	2024-08-07T00:00:00
db:	NVD	id:	CVE-2024-41691	date:	2024-07-26T12:15:03.753