PT-2024-3750 · Unknown · Opupi0 Amqp/Mqtt

Constantin Schieber-Knoebl + 3 · Published 2024-05-14 · Updated 2024-07-09 · CVE-2024-31486

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: OPUPI0 AMQP/MQTT versions prior to V5.30

Description: A vulnerability has been identified that allows an attacker with remote shell access or physical access to retrieve credentials due to insufficient protection of stored MQTT client passwords, leading to confidentiality loss. The issue is related to the storage of confidential information without encryption.

Recommendations: For versions prior to V5.30, update to version V5.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation. Avoid using the device until the issue is resolved.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

BDU:2024-04096

CVE-2024-31486

Affected Products

Opupi0 Amqp/Mqtt

References · 7

• https://bdu.fstec.ru/vul/2024-04096 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-31486 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-871704.html · Note
• http://seclists.org/fulldisclosure/2025/Feb/19 · Note
• https://twitter.com/Action1corp/status/1810738390163411390 · Twitter Post
• https://t.me/true_secator/5903 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Jul/4 · Note