CVE-2024-38279 Authentication Bypass Using an Alternate Path or Channel in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)

2024-06-1317:00:20

CWE-288

icscert

www.cve.org

motorola solutions

vulnerability

authentication bypass

bootloader modification

file system access

password hashes

5.1 Medium

CVSS4

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Vigilant Fixed LPR Coms Box (BCAV1F2-C600)",
    "vendor": "Motorola Solutions",
    "versions": [
      {
        "lessThanOrEqual": "3.1.171.9",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]