Medium severity · published Jul 26, 2024
CVE-2024-41684
Cookie Without Secure Flag Set Vulnerability
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system.
Successful exploitation of this vulnerability could allow the attacker to capture cookies and compromise the targeted system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SyroTech SY-GPON-1110-WDONT router · SyroTech
3.1.02-231102 · source: vendor
SF
Sy-gpon-1110-wdont Firmware · Syrotech
3.1.02-231102 · source: NVD
Affected product
SS
SyroTech SY-GPON-1110-WDONT router
SyroTech
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41684
Third Party Advisory
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
cert-in.org.in
https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
More from SyroTech SY-GPON-1110-WDONT router
8.6
CVE-2024-41692
Incorrect Access Control Vulnerability
7.5
CVE-2024-41687
Cleartext Transmission of Sensitive Information Vulnerability
7.5
CVE-2024-41685
Cookie Without HTTPOnly Flag Set Vulnerability
4.6
CVE-2024-41691
Insecure Storage of Sensitive Information Vulnerability
4.6
CVE-2024-41690
Default Credential Storage in Plaintext Vulnerability