PT-2024-39592 · Unknown · Thingsboard

Lujiefsi · CVE-2024-9358 · Published 2024-09-30 · Updated 2025-12-03

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ThingsBoard versions up to 3.7.0

Description A vulnerability has been found in the HTTP RPC API component of ThingsBoard, which can lead to resource consumption. The attack can be launched remotely, but the complexity of an attack is rather high and the exploitation appears to be difficult. The issue is classified as problematic and affects an unknown functionality of the component.

Recommendations For versions up to 3.7.0, upgrade to version 3.7.1 to address this issue. As a temporary workaround, consider restricting access to the HTTP RPC API component until the upgrade is applied.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-9358

Affected Products

Thingsboard

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9358.json · Exploit
• 🔥 https://1drv.ms/v/s!AksJ421iyCG-mytAcEUF6WqOTwj2?e=6WAp5G · Exploit
• 🔥 https://vuldb.com/?submit.379486 · Exploit
• https://osv.dev/vulnerability/CVE-2024-9358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9358 · Security Note
• https://t.me/cveNotify/144609 · Telegram Post
• https://vuldb.com/?id.278887 · Note
• https://vuldb.com/?ctiid.278887 · Note
• https://twitter.com/VulmonFeeds/status/1840994474983342487 · Twitter Post
• https://twitter.com/CVEnew/status/1840923645935284653 · Twitter Post