PT-2024-31958 · Vonets · Vonets Vap11G-300

Published 2024-09-26 · Updated 2025-05-29 · CVE-2024-46328

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VONETS VAP11G-300 version 3.3.23.6.9

Description The issue concerns hardcoded credentials for several different privileged accounts, including root, in the VONETS VAP11G-300 device. This could potentially allow unauthorized access to the device.

Recommendations For version 3.3.23.6.9, consider changing the hardcoded credentials for all privileged accounts, including root, to unique and secure passwords as a temporary mitigation measure. Additionally, restrict access to the device until a patch or update is available that removes the hardcoded credentials.

Fix

Weakness Enumeration

CWE-259

Related Identifiers

CVE-2024-46328

Affected Products

Vonets Vap11G-300

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-46328 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46328 · Vendor Advisory
• https://t.me/cvenotify/124011 · Telegram Post
• https://hawktesters.com/5519644d-246e-4924-b7c8-8fdf742117be/9461d352-c4f6-477f-a44e-b91ff71e6d84.pdf · Note
• https://twitter.com/cracbot/status/1840995124215758899 · Twitter Post
• https://t.me/cvedetector/6412 · Telegram Post
• https://twitter.com/CVEnew/status/1839301747145060436 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1839380118243865015 · Twitter Post