CVE-2024-3765
Assigner: VulDB
Published: 2024-04-14T23:00:05.199Z
State: PUBLISHED
title: Xiongmai AHB7804R-MH-V2 Sofia Service access control
problemTypes: descriptions: type: CWE
cweId: CWE-284
description: CWE-284 Improper Access Controls
affected: vendor: Xiongmai
product: AHB7804R-MH-V2
versions: version: 4.02.R11.24340142.10001.131900.00000
status: affected
version: 4.02.R11.A8531149.10001.131900.00000
status: affected
version: 4.02.R11.C6380171.11201.141900.00000
status: affected
version: 4.03.R11.0000020X.11201.042300.0000005
status: affected
version: 4.03.R11.4912720B.11201.142300.0000004
status: affected
version: 4.03.R11.4912720D.11201.142300.0000004
status: affected
version: 4.03.R11.4915714A.12201.142300.0000000
status: affected
version: 5.00.R02.00030751.10010.348717.0000000
status: affected
modules: Sofia Service
vendor: Xiongmai
product: AHB8004T-GL
versions: version: 4.02.R11.24340142.10001.131900.00000
status: affected
version: 4.02.R11.A8531149.10001.131900.00000
status: affected
version: 4.02.R11.C6380171.11201.141900.00000
status: affected
version: 4.03.R11.0000020X.11201.042300.0000005
status: affected
version: 4.03.R11.4912720B.11201.142300.0000004
status: affected
version: 4.03.R11.4912720D.11201.142300.0000004
status: affected
version: 4.03.R11.4915714A.12201.142300.0000000
status: affected
version: 5.00.R02.00030751.10010.348717.0000000
status: affected
modules: Sofia Service
vendor: Xiongmai
product: AHB8008T-GL
versions: version: 4.02.R11.24340142.10001.131900.00000
status: affected
version: 4.02.R11.A8531149.10001.131900.00000
status: affected
version: 4.02.R11.C6380171.11201.141900.00000
status: affected
version: 4.03.R11.0000020X.11201.042300.0000005
status: affected
version: 4.03.R11.4912720B.11201.142300.0000004
status: affected
version: 4.03.R11.4912720D.11201.142300.0000004
status: affected
version: 4.03.R11.4915714A.12201.142300.0000000
status: affected
version: 5.00.R02.00030751.10010.348717.0000000
status: affected
modules: Sofia Service
vendor: Xiongmai
product: AHB7004T-GS-V3
versions: version: 4.02.R11.24340142.10001.131900.00000
status: affected
version: 4.02.R11.A8531149.10001.131900.00000
status: affected
version: 4.02.R11.C6380171.11201.141900.00000
status: affected
version: 4.03.R11.0000020X.11201.042300.0000005
status: affected
version: 4.03.R11.4912720B.11201.142300.0000004
status: affected
version: 4.03.R11.4912720D.11201.142300.0000004
status: affected
version: 4.03.R11.4915714A.12201.142300.0000000
status: affected
version: 5.00.R02.00030751.10010.348717.0000000
status: affected
modules: Sofia Service
vendor: Xiongmai
product: AHB7004T-MHV2
versions: version: 4.02.R11.24340142.10001.131900.00000
status: affected
version: 4.02.R11.A8531149.10001.131900.00000
status: affected
version: 4.02.R11.C6380171.11201.141900.00000
status: affected
version: 4.03.R11.0000020X.11201.042300.0000005
status: affected
version: 4.03.R11.4912720B.11201.142300.0000004
status: affected
version: 4.03.R11.4912720D.11201.142300.0000004
status: affected
version: 4.03.R11.4915714A.12201.142300.0000000
status: affected
version: 5.00.R02.00030751.10010.348717.0000000
status: affected
modules: Sofia Service
vendor: Xiongmai
product: AHB8032F-LME
versions: version: 4.02.R11.24340142.10001.131900.00000
status: affected
version: 4.02.R11.A8531149.10001.131900.00000
status: affected
version: 4.02.R11.C6380171.11201.141900.00000
status: affected
version: 4.03.R11.0000020X.11201.042300.0000005
status: affected
version: 4.03.R11.4912720B.11201.142300.0000004
status: affected
version: 4.03.R11.4912720D.11201.142300.0000004
status: affected
version: 4.03.R11.4915714A.12201.142300.0000000
status: affected
version: 5.00.R02.00030751.10010.348717.0000000
status: affected
modules: Sofia Service
vendor: Xiongmai
product: XM530_R80X30-PQ_8M
versions: version: 4.02.R11.24340142.10001.131900.00000
status: affected
version: 4.02.R11.A8531149.10001.131900.00000
status: affected
version: 4.02.R11.C6380171.11201.141900.00000
status: affected
version: 4.03.R11.0000020X.11201.042300.0000005
status: affected
version: 4.03.R11.4912720B.11201.142300.0000004
status: affected
version: 4.03.R11.4912720D.11201.142300.0000004
status: affected
version: 4.03.R11.4915714A.12201.142300.0000000
status: affected
version: 5.00.R02.00030751.10010.348717.0000000
status: affected
modules: Sofia Service
descriptions: value: A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R80X30-PQ_8M. Affected by this vulnerability is an unknown functionality of the component Sofia Service. The manipulation with the input ff00000000000000000000000000f103250000007b202252657422203a203130302c202253657373696f6e494422203a202230783022207d0a leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260605 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
value: In Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R80X30-PQ_8M wurde eine kritische Schwachstelle entdeckt. Es geht um eine nicht näher bekannte Funktion der Komponente Sofia Service. Durch Manipulation mit der Eingabe ff00000000000000000000000000f103250000007b202252657422203a203130302c202253657373696f6e494422203a202230783022207d0a mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
metrics: cvssV3_1: version: 3.1
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseSeverity: CRITICAL
cvssV3_0: version: 3.0
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseSeverity: CRITICAL
cvssV2_0: version: 2.0
baseScore: 10
vectorString: AV:N/AC:L/Au:N/C:C/I:C/A:C
timeline: time: 2024-04-14T00:00:00.000Z
value: Advisory disclosed
time: 2024-04-14T02:00:00.000Z
value: VulDB entry created
time: 2024-04-14T10:50:01.000Z
value: VulDB entry last update
credits: value: netsecfish (VulDB User)
type: reporter