PT-2025-3266 · Axess · Axess Acs

Christian Becker + 1 · Published 2025-01-20 · Updated 2025-01-28 · CVE-2024-56316

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AXESS ACS (Auto Configuration Server) versions prior to 5.2.0

Description The issue is related to unsanitized user input in the TR069 API, which allows remote unauthenticated attackers to cause a permanent Denial of Service via crafted TR069 requests on TCP port 9675 or 7547. Rebooting does not resolve the permanent Denial of Service.

Recommendations For AXESS ACS (Auto Configuration Server) versions prior to 5.2.0, as a temporary workaround, consider disabling the TR069 API until a patch is available. Restrict access to the TR069 API on TCP port 9675 or 7547 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-56316

Affected Products

Axess Acs

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-56316 · Security Note
• https://t.me/cvenotify/108796 · Telegram Post
• https://twitter.com/YSecurity/status/1881281263954514076 · Twitter Post
• https://t.me/cvedetector/16553 · Telegram Post
• https://y-security.de/news-en/axess-auto-configuration-server-denial-of-service-cve-2024-56316 · Note
• https://twitter.com/CVEnew/status/1884183348198924361 · Twitter Post