CVE-2024-4232

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-4232
This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext passwords on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.

4.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 3.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0158
Configurations

No configuration.

History

03 Jul 2024, 02:07

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.1

05 Jun 2024, 13:15

Type Values Removed Values Added
CWE CWE-256
Summary
  • (es) Esta vulnerabilidad existe en Digisol Router (DG-GR1321: versión de hardware 3.7L; versión de firmware: v3.2.02) debido a la presencia de acceso al terminal raíz en una interfaz serie sin el control de acceso adecuado. Un atacante con acceso físico podría aprovechar esto identificando los pines UART y accediendo al shell raíz del sistema vulnerable. La explotación exitosa de esta vulnerabilidad podría permitir al atacante acceder a información confidencial en el sistema objetivo. Esta vulnerabilidad existe en Digisol Router (DG-GR1321: versión de hardware 3.7L; versión de firmware: v3.2.02) debido a la falta de cifrado o hash en almacenamiento de contraseñas dentro del firmware/base de datos del enrutador. Un atacante con acceso físico podría aprovechar esto extrayendo el firmware y aplicando ingeniería inversa a los datos binarios para acceder a las contraseñas de texto sin formato en el sistema vulnerable. La explotación exitosa de esta vulnerabilidad podría permitir al atacante obtener acceso no autorizado al sistema objetivo.
Summary (en) This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by identifying UART pins and accessing the root shell on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to access the sensitive information on the targeted system.This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext passwords on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system. (en) This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext passwords on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.

14 May 2024, 15:43

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-14 15:43

Updated : 2024-07-03 02:07

NVD link : CVE-2024-4232

Mitre link : CVE-2024-4232

CVE.ORG link : CVE-2024-4232

JSON object : View

Products Affected

No product.

CWE
CWE-256

Unprotected Storage of Credentials