CVE-2024-38285 - Vulnerability Details - OpenCVE

Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0011.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Motorolasolutions Subscribe	Vigilant Fixed Lpr Coms Box Bcav1f2 C600 Subscribe

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-37246	Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.

Fixes

Solution

Motorola Solutions recommends the following for each identified vulnerability: CVE-2024-38285: * Delete the log files. Motorola Solutions has already remediated this vulnerability for all vulnerable systems. No further actions are required by customers.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2024-06-13T17:26:46.091Z

Updated: 2024-08-02T04:04:25.101Z

Reserved: 2024-06-12T16:16:09.649Z

Link: CVE-2024-38285

Vulnrichment

Updated: 2024-06-17T19:38:31.535Z

NVD

Status : Awaiting Analysis

Published: 2024-06-13T18:15:11.547

Modified: 2024-11-21T09:25:17.307

Link: CVE-2024-38285

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-522

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38285", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-06-12T16:16:09.649Z", "datePublished": "2024-06-13T17:26:46.091Z", "dateUpdated": "2024-08-02T04:04:25.101Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Vigilant Fixed LPR Coms Box (BCAV1F2-C600)", "vendor": "Motorola Solutions", "versions": [{"lessThanOrEqual": "3.1.171.9", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "The Michigan State Police Michigan Cyber Command Center (MC3)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.</p><br>\n\n"}], "value": "Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "baseScore": 7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-06-13T17:26:46.091Z"}, "references": [{"tags": ["government-resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Motorola Solutions recommends the following for each identified vulnerability:</p>\n\n<p>CVE-2024-38285:</p><ul><li>Delete the log files.</li></ul><p>Motorola Solutions has already remediated this vulnerability for all vulnerable systems. No further actions are required by customers.</p>\n\n<br>"}], "value": "Motorola Solutions recommends the following for each identified vulnerability:\n\n\n\nCVE-2024-38285:\n\n * Delete the log files.\n\n\nMotorola Solutions has already remediated this vulnerability for all vulnerable systems. No further actions are required by customers."}], "source": {"discovery": "UNKNOWN"}, "title": "Insufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "motorolasolutions", "product": "vigilant_fixed_lpr_coms_box_bcav1f2_c600", "cpes": ["cpe:2.3:a:motorolasolutions:vigilant_fixed_lpr_coms_box_bcav1f2_c600:0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.171.9", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-13T19:14:40.437180Z", "id": "CVE-2024-38285", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:38:39.089Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:04:25.101Z"}, "title": "CVE Program Container", "references": [{"tags": ["government-resource", "x_transferred"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38285", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-13T19:14:40.437180Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:motorolasolutions:vigilant_fixed_lpr_coms_box_bcav1f2_c600:0:*:*:*:*:*:*:*"], "vendor": "motorolasolutions", "product": "vigilant_fixed_lpr_coms_box_bcav1f2_c600", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.1.171.9"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:38:31.535Z"}}], "cna": {"title": "Insufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "The Michigan State Police Michigan Cyber Command Center (MC3)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Motorola Solutions", "product": "Vigilant Fixed LPR Coms Box (BCAV1F2-C600)", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.1.171.9"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Motorola Solutions recommends the following for each identified vulnerability:\n\n\n\nCVE-2024-38285:\n\n * Delete the log files.\n\n\nMotorola Solutions has already remediated this vulnerability for all vulnerable systems. No further actions are required by customers.", "supportingMedia": [{"type": "text/html", "value": "<p>Motorola Solutions recommends the following for each identified vulnerability:</p>\n\n<p>CVE-2024-38285:</p><ul><li>Delete the log files.</li></ul><p>Motorola Solutions has already remediated this vulnerability for all vulnerable systems. No further actions are required by customers.</p>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.", "supportingMedia": [{"type": "text/html", "value": "\n\n<p>Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.</p><br>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-06-13T17:26:46.091Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38285", "state": "PUBLISHED", "dateUpdated": "2024-06-17T19:38:39.089Z", "dateReserved": "2024-06-12T16:16:09.649Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2024-06-13T17:26:46.091Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools."}, {"lang": "es", "value": "Los registros que almacenan credenciales no est\u00e1n suficientemente protegidos y pueden decodificarse mediante el uso de herramientas de c\u00f3digo abierto."}], "id": "CVE-2024-38285", "lastModified": "2024-11-21T09:25:17.307", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "HIGH"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2024-06-13T18:15:11.547", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}