PT-2024-39300 · Circutor · Circutor Q-Smt

Aarón Flecha + 1 · Published 2024-09-18 · Updated 2024-10-01 · CVE-2024-8888

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4

Description: An attacker with access to the network where CIRCUTOR Q-SMT is located could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.

Recommendations: For CIRCUTOR Q-SMT version 1.0.4, consider implementing token expiration to restrict access to the web application. As a temporary workaround, restrict access to the network where CIRCUTOR Q-SMT is located to minimize the risk of token theft. Additionally, monitor network activity and locally stored web information for potential security breaches. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2024-8888

Affected Products

Circutor Q-Smt

References · 9

• https://osv.dev/vulnerability/CVE-2024-8888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8888 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products · Note
• https://t.me/cvenotify/95058 · Telegram Post
• https://twitter.com/Vu1nAlert/status/1836393184303124729 · Twitter Post
• https://twitter.com/CVEnew/status/1836396590183162120 · Twitter Post
• https://twitter.com/CveFindCom/status/1836375539579273484 · Twitter Post
• https://t.me/latest_high_impact_cve/1168 · Telegram Post
• https://t.me/cvedetector/5952 · Telegram Post