PT-2024-39302 · Circutor · Circutor Q-Smt

Aarón Flecha + 2 · Published 2024-09-18 · Updated 2024-10-01 · CVE-2024-8890

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4

Description: An attacker with access to the network where the CIRCUTOR Q-SMT is located could obtain legitimate credentials or steal sessions due to the fact that the device only implements the HTTP protocol, preventing a secure communication channel from being established.

Recommendations: For version 1.0.4, consider disabling the use of the HTTP protocol until a patch is available, and restrict access to sensitive data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2024-8890

Affected Products

Circutor Q-Smt

References · 9

• https://osv.dev/vulnerability/CVE-2024-8890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8890 · Security Note
• https://t.me/cvenotify/95070 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products · Note
• https://t.me/cvedetector/5957 · Telegram Post
• https://t.me/cvenotify/96714 · Telegram Post
• https://twitter.com/oktsec/status/1836414336522166635 · Twitter Post
• https://twitter.com/CVEnew/status/1836396586949316631 · Twitter Post
• https://t.me/latest_high_impact_cve/1169 · Telegram Post