Medium severity · published Jun 13, 2024
CVE-2024-38279
The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain…
4.6
CVSS
0.3%
EPSS
No
On KEV
Description
The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VF
Vigilant Fixed Lpr Coms Box Firmware · Motorola
through 3.1.171.9 · source: NVD
Affected product
VF
Vigilant Fixed Lpr Coms Box Firmware
Motorola
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38279
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38279
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19
More from Vigilant Fixed Lpr Coms Box Firmware
9.8
CVE-2024-38281
An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device
4.6
CVE-2024-38280
An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text