CVE-2024-2413

Katalog CVE

CVSS 9.8 · Critical EPSS 0,57%

Kerentanan Use of Hard-coded Cryptographic Key pada intumit smartrobot. Skor CVSS 3.1 9.8 (Critical) menurut cert.org.tw.

Deskripsi (NVD)

Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timestamp to generate an authentication code. With this authentication code, they can obtain administrator privileges and subsequently execute arbitrary code on the remote server using built-in system functionality.

Rincian

Terbit di NVD

13 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber cert.org.tw
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-321: Use of Hard-coded Cryptographic Key

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.twcert.org.tw/tw/cp-132-7697-ecf10-1.html advisory pihak ketiga