PT-2024-22955 · Cmsv6 · Cmsv6

Published 2024-03-25 · Updated 2024-08-27 · CVE-2024-29666

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vehicle Monitoring platform system CMSV6 versions 7.31.0.2 through 7.32.0.3

Description The issue allows a remote attacker to escalate privileges via the default password component. This is an Insecure Permissions vulnerability.

Recommendations For versions 7.31.0.2 through 7.32.0.3, consider changing the default password component to prevent privilege escalation. As a temporary workaround, restrict access to the default password component until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-1393

Related Identifiers

CVE-2024-29666

Affected Products

Cmsv6

References · 6

• 🔥❌ https://github.com/whgojp/cve-reports/wiki/There-is-a-weak-password-in-the-CMSV6-vehicle-monitoring-platform-system · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2024-29666 · Security Note
• https://t.me/cvenotify/74610 · Telegram Post
• https://t.me/cvenotify/74682 · Telegram Post
• https://twitter.com/CVEnew/status/1772340998019977365 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1772359937399607497 · Twitter Post