PT-2024-36459 · Quectel · Quectel Bg96

Published 2024-12-19 · Updated 2025-01-07 · CVE-2024-54984

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quectel BG96 version BG96MAR02A08M1G

Description An issue in Quectel BG96 allows attackers to bypass authentication via a crafted NAS message. The supplier disputes this issue.

Recommendations For Quectel BG96 version BG96MAR02A08M1G, consider restricting access to the NAS message handling functionality until a patch or official fix is available from the supplier. As a temporary workaround, disabling the authentication bypass mechanism related to crafted NAS messages may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-54984

Affected Products

Quectel Bg96

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-54984 · Security Note
• https://t.me/cvedetector/13383 · Telegram Post
• https://t.me/cvenotify/105023 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1869883142720352572 · Twitter Post
• https://twitter.com/CVEnew/status/1869868680504586458 · Twitter Post
• https://github.com/haroldfeng/nbiot-va/blob/master/Quecctel_BG96_Message_Auth_Bypass.md · Note