Lucene search

IcscertCVE-2024-38280

HistoryJun 13, 2024 - 5:15 p.m.

CVE-2024-38280

2024-06-1317:15:51

CWE-313

icscert

web.nvd.nist.gov

cve-2024-38280

cleartext storage

unauthorized access

sensitive data

credentials

physical retrieval

CVSS4

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

6.4

Confidence

Low

EPSS

Percentile

9.0%

JSON

An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Vigilant Fixed LPR Coms Box (BCAV1F2-C600)",
    "vendor": "Motorola Solutions",
    "versions": [
      {
        "lessThanOrEqual": "3.1.171.9",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-24-165-19

CVSS4

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

6.4

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-38280