PT-2025-6514 · Zettlr · Zettlr

Diego Zaffaroni · Published 2025-02-13 · Updated 2025-02-17 · CVE-2024-12013

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Zettler - 130.8005 version 12h

Description A CWE-1392 issue was discovered, affecting the device's FTP server, which uses default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could gain access and perform changes to resources exposed by the service, such as configuration files where password hashes are saved or where network settings are stored.

Recommendations For version 12h, change the default admin credentials of the FTP server to strong, unique credentials to prevent unauthorized access. As a temporary workaround, consider disabling the FTP server until secure credentials are implemented. Restrict access to the FTP server to minimize the risk of exploitation. Avoid using default or easy-to-guess credentials for the admin account.

Fix

Weakness Enumeration

CWE-1392

Related Identifiers

CVE-2024-12013

Affected Products

Zettlr

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-12013 · Security Note
• https://t.me/cvedetector/18037 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1890085542722785709 · Twitter Post
• https://twitter.com/CVEnew/status/1890150867694989608 · Twitter Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2024-12013 · Note
• https://twitter.com/cybercronai/status/1891404880868225243 · Twitter Post