Medium severity · published Jul 26, 2024
CVE-2024-41689
Hard-coded Credentials Vulnerability
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext WPA/ WPS credentials on the vulnerable system.
Successful exploitation of this vulnerability could allow the attacker to bypass WPA/ WPS and gain access to the Wi-Fi network of the targeted system.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SyroTech SY-GPON-1110-WDONT router · SyroTech
3.1.02-231102 · source: vendor
SF
Sy-gpon-1110-wdont Firmware · Syrotech
3.1.02-231102 · source: NVD
Affected product
SS
SyroTech SY-GPON-1110-WDONT router
SyroTech
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41689
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41689
Third Party Advisory
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
cert-in.org.in
https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
More from SyroTech SY-GPON-1110-WDONT router
8.6
CVE-2024-41692
Incorrect Access Control Vulnerability
7.5
CVE-2024-41687
Cleartext Transmission of Sensitive Information Vulnerability
7.5
CVE-2024-41685
Cookie Without HTTPOnly Flag Set Vulnerability
5.3
CVE-2024-41684
Cookie Without Secure Flag Set Vulnerability
4.6
CVE-2024-41691
Insecure Storage of Sensitive Information Vulnerability
