CVE-2024-8889

Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:circutor:tcp2rs\+_firmware:1.3b:*:*:*:*:*:*:*

cpe:2.3:h:circutor:tcp2rs\+:-:*:*:*:*:*:*:*

History

07 Oct 2024, 17:09

Type	Values Removed	Values Added
First Time		Circutor Circutor tcp2rs\+ Circutor tcp2rs\+ Firmware
CPE		cpe:2.3:h:circutor:tcp2rs\+_firmware:1.3b:::::::* cpe:2.3:h:circutor:tcp2rs\+:-:::::::*
References	~~() https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products -~~	() https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products - Third Party Advisory
CWE		NVD-CWE-noinfo
CVSS	v2 : ~~unknown~~ v3 : ~~9.3~~	v2 : unknown v3 : 9.1

20 Sep 2024, 12:30

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en la versión de firmware 1.3b de CIRCUTOR TCP2RS+, que podría permitir a un atacante modificar cualquier valor de configuración, incluso si el equipo tiene habilitada la opción de autenticación de usuario/contraseña, sin autenticación mediante el envío de paquetes a través del protocolo UDP y el puerto 2000, desconfigurando el equipo y deshabilitando así su uso. Este equipo se encuentra al final de su ciclo de vida útil.

18 Sep 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-18 12:15

Updated : 2024-10-07 17:09

NVD link : CVE-2024-8889

Mitre link : CVE-2024-8889

CVE.ORG link : CVE-2024-8889

JSON object : View

Products Affected

circutor

tcp2rs\+_firmware
tcp2rs\+

CWE

NVD-CWE-noinfo CWE-20

Improper Input Validation

{"id": "CVE-2024-8889", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "published": "2024-09-18T12:15:03.710", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products", "tags": ["Third Party Advisory"], "source": "cve-coordination@incibe.es"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle."}, {"lang": "es", "value": "Vulnerabilidad en la versi\u00f3n de firmware 1.3b de CIRCUTOR TCP2RS+, que podr\u00eda permitir a un atacante modificar cualquier valor de configuraci\u00f3n, incluso si el equipo tiene habilitada la opci\u00f3n de autenticaci\u00f3n de usuario/contrase\u00f1a, sin autenticaci\u00f3n mediante el env\u00edo de paquetes a trav\u00e9s del protocolo UDP y el puerto 2000, desconfigurando el equipo y deshabilitando as\u00ed su uso. Este equipo se encuentra al final de su ciclo de vida \u00fatil."}], "lastModified": "2024-10-07T17:09:27.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:circutor:tcp2rs\\+_firmware:1.3b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "522FE1C3-3EED-4EC0-B946-5ACD71ACF6DB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:circutor:tcp2rs\\+:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D3A95ECE-C9F7-477A-862E-EEFA050D4FE0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve-coordination@incibe.es"}