Medium severity · published Jul 26, 2024
CVE-2024-41690
Default Credential Storage in Plaintext Vulnerability
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext default credentials on the vulnerable system.
Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SyroTech SY-GPON-1110-WDONT router · SyroTech
3.1.02-231102 · source: vendor
SF
Sy-gpon-1110-wdont Firmware · Syrotech
3.1.02-231102 · source: NVD, CISA
Affected product
SS
SyroTech SY-GPON-1110-WDONT router
SyroTech
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41690
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41690
Third Party Advisory
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
cert-in.org.in
https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
More from SyroTech SY-GPON-1110-WDONT router
8.6
CVE-2024-41692
Incorrect Access Control Vulnerability
7.5
CVE-2024-41687
Cleartext Transmission of Sensitive Information Vulnerability
7.5
CVE-2024-41685
Cookie Without HTTPOnly Flag Set Vulnerability
5.3
CVE-2024-41684
Cookie Without Secure Flag Set Vulnerability
4.6
CVE-2024-41691
Insecure Storage of Sensitive Information Vulnerability
