PT-2024-14279 · Skyworth · Skyworth Router Cm5100

Dr. Faruk Kazi + 3 · Published 2024-01-17 · Updated 2024-01-20 · CVE-2023-51740

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Skyworth Router CM5100 version 4.1.1.24

Description This issue exists due to the transmission of authentication credentials in plaintext over the network. A remote attacker could exploit this by eavesdropping on the victim’s network traffic to extract the username and password from the web interface (Login Page) of the targeted system.

Recommendations For Skyworth Router CM5100 version 4.1.1.24, consider disabling the login functionality over the network until a patch is available to prevent the transmission of credentials in plaintext. Restrict access to the web interface to minimize the risk of exploitation. Avoid using the vulnerable login page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-51740

Affected Products

Skyworth Router Cm5100

References · 5

• https://osv.dev/vulnerability/CVE-2023-51740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51740 · Security Note
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0013 · Note
• https://twitter.com/VulmonFeeds/status/1747581396254667208 · Twitter Post
• https://twitter.com/CVEnew/status/1747527252869259483 · Twitter Post