PT-2024-16044 · Unknown · Wfh45678 Radar

Buxiaoding · Published 2024-10-18 · Updated 2024-10-30 · CVE-2024-10121

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wfh45678 Radar versions up to 1.0.8

Description A critical issue affects the Interface Handler component, allowing for authorization bypass through manipulation of the input /../. This can be initiated remotely and is not considered a path traversal weakness. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For wfh45678 Radar versions up to 1.0.8, as a temporary workaround, consider restricting access to the Interface Handler component until a patch is available. Avoid using the input /../ in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-10121

Affected Products

Wfh45678 Radar

References · 9

• 🔥 https://github.com/weliveby/ForCVE/blob/main/radar%20Authentication%20bypass%20vulnerability.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-10121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10121 · Security Note
• https://vuldb.com/?ctiid.280913 · Note
• https://twitter.com/CVEnew/status/1847348150207492407 · Twitter Post
• https://vuldb.com/?submit.420960 · Note
• https://vuldb.com/?id.280913 · Note
• https://twitter.com/VulmonFeeds/status/1847382208954454231 · Twitter Post
• https://t.me/cvedetector/8340 · Telegram Post