PT-2024-31879 · Socomec · Socomec Net Vision

José Daniel Martínez Coronel · Published 2024-05-07 · Updated 2024-05-07 · CVE-2024-4601

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Socomec Net Vision version 7.20

Description An incorrect authentication issue has been found, allowing an attacker to perform a brute force attack on the application and recover a valid session. This is possible because the application uses a five-digit integer value for authentication.

Recommendations For Socomec Net Vision version 7.20, consider implementing additional authentication measures to prevent brute force attacks, such as account lockout policies or two-factor authentication, until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-4601

Affected Products

Socomec Net Vision

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-4601 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-socomec-net-vision · Note
• https://t.me/cvenotify/79388 · Telegram Post
• https://twitter.com/CVEnew/status/1787888356707156401 · Twitter Post