CVE-2024-24300

4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, the content of the cookie remains unchanged.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/yckuo-sdc/PoC	Third Party Advisory Exploit
https://github.com/yckuo-sdc/PoC	Third Party Advisory Exploit

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:4ipnet:eap-767_firmware:3.42.00:*:*:*:*:*:*:*

cpe:2.3:h:4ipnet:eap-767:*:*:*:*:*:*:*:*

History

25 Mar 2025, 15:18

Type	Values Removed	Values Added
First Time		4ipnet eap-767 Firmware 4ipnet eap-767 4ipnet
References	~~() https://github.com/yckuo-sdc/PoC -~~	() https://github.com/yckuo-sdc/PoC - Third Party Advisory, Exploit
CPE		cpe:2.3:o:4ipnet:eap-767_firmware:3.42.00:::::::* cpe:2.3:h:4ipnet:eap-767::::::::

21 Nov 2024, 08:59

Type	Values Removed	Values Added
References	~~() https://github.com/yckuo-sdc/PoC -~~	() https://github.com/yckuo-sdc/PoC -

16 Aug 2024, 19:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
CWE		CWE-284
Summary		(es) 4ipnet EAP-767 v3.42.00 es vulnerable a un control de acceso incorrecto. El dispositivo utiliza el mismo conjunto de credenciales, independientemente de cuántas veces inicie sesión un usuario, el contenido de la cookie permanece sin cambios.

14 Feb 2024, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-14 23:15

Updated : 2025-03-25 15:18

NVD link : CVE-2024-24300

Mitre link : CVE-2024-24300

CVE.ORG link : CVE-2024-24300

JSON object : View

Products Affected

4ipnet

eap-767
eap-767_firmware

CWE

CWE-284

Improper Access Control

{"id": "CVE-2024-24300", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-02-14T23:15:08.140", "references": [{"url": "https://github.com/yckuo-sdc/PoC", "tags": ["Third Party Advisory", "Exploit"], "source": "cve@mitre.org"}, {"url": "https://github.com/yckuo-sdc/PoC", "tags": ["Third Party Advisory", "Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, the content of the cookie remains unchanged."}, {"lang": "es", "value": "4ipnet EAP-767 v3.42.00 es vulnerable a un control de acceso incorrecto. El dispositivo utiliza el mismo conjunto de credenciales, independientemente de cu\u00e1ntas veces inicie sesi\u00f3n un usuario, el contenido de la cookie permanece sin cambios."}], "lastModified": "2025-03-25T15:18:50.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:4ipnet:eap-767_firmware:3.42.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "749DEC39-A6BB-4E3F-B915-40E12F20E4CE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:4ipnet:eap-767:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "457B53E2-307F-462C-813C-0D6F9500045F"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}

9.8 /10