Critical severity · published Jun 13, 2024
CVE-2024-38281
An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VF
Vigilant Fixed Lpr Coms Box Firmware · Motorola
through 3.1.171.9 · source: NVD
Affected product
VF
Vigilant Fixed Lpr Coms Box Firmware
Motorola
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38281
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38281
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19
More from Vigilant Fixed Lpr Coms Box Firmware
4.6
CVE-2024-38280
An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text
4.6
CVE-2024-38279
The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain…