Medium severity · published Oct 1, 2024
CVE-2024-25658
Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the database or exported configuration files)…
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the database or exported configuration files) to obtain SNMP users' usernames and passwords in cleartext.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TN
Transcend Network Management System · Nokia
19.10.3 · source: NVD
Affected product
TN
Transcend Network Management System
Nokia
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-25658
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-25658
Third Party Advisory
https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25658
More from Transcend Network Management System
9.0
CVE-2024-25660
The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operations, because of…
7.7
CVE-2024-25661
In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client allows guest OS…
7.2
CVE-2024-25659
In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote attacker to access…