CVE-2024-42001 - Vulnerability Details

Vendors	Products
Vonets	Vap11ac Vap11ac Firmware Vap11g Vap11g-300 Vap11g-300 Firmware Vap11g-500 Vap11g-500 Firmware Vap11g-500s Vap11g-500s Firmware Vap11g Firmware Vap11n-300 Vap11n-300 Firmware Vap11s Vap11s-5g Vap11s-5g Firmware Vap11s Firmware Var11n-300 Var11n-300 Firmware Var1200-h Var1200-h Firmware Var1200-l Var1200-l Firmware Var600-h Var600-h Firmware Vbg1200 Vbg1200 Firmware Vga-1000 Vga-1000 Firmware

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:vonets:vap11ac_firmware:::::::: cpe:2.3:a:vonets:vap11g-300_firmware:::::::: cpe:2.3:a:vonets:vap11g-500s_firmware:::::::: cpe:2.3:a:vonets:vap11g_firmware:::::::: cpe:2.3:a:vonets:vap11n-300_firmware:::::::: cpe:2.3:a:vonets:vap11s-5g_firmware:::::::: cpe:2.3:a:vonets:vap11s_firmware:::::::: cpe:2.3:a:vonets:var11n-300_firmware:::::::: cpe:2.3:a:vonets:var1200-h_firmware:::::::: cpe:2.3:a:vonets:var1200-l_firmware:::::::: cpe:2.3:a:vonets:var600-h_firmware:::::::: cpe:2.3:a:vonets:vbg1200_firmware:::::::: cpe:2.3:a:vonets:vga-1000_firmware::::::::

Type	Values Removed	Values Added
First Time appeared		Vonets vap11ac Vonets vap11g Vonets vap11g-300 Vonets vap11g-500 Vonets vap11g-500 Firmware Vonets vap11g-500s Vonets vap11n-300 Vonets vap11s Vonets vap11s-5g Vonets var11n-300 Vonets var1200-h Vonets var1200-l Vonets var600-h Vonets vbg1200 Vonets vga-1000
CPEs		cpe:2.3:h:vonets:vap11ac:-:::::::* cpe:2.3:h:vonets:vap11g-300:-:::::::* cpe:2.3:h:vonets:vap11g-500:-:::::::* cpe:2.3:h:vonets:vap11g-500s:-:::::::* cpe:2.3:h:vonets:vap11g:-:::::::* cpe:2.3:h:vonets:vap11n-300:-:::::::* cpe:2.3:h:vonets:vap11s-5g:-:::::::* cpe:2.3:h:vonets:vap11s:-:::::::* cpe:2.3:h:vonets:var11n-300:-:::::::* cpe:2.3:h:vonets:var1200-h:-:::::::* cpe:2.3:h:vonets:var1200-l:-:::::::* cpe:2.3:h:vonets:var600-h:-:::::::* cpe:2.3:h:vonets:vbg1200:-:::::::* cpe:2.3:h:vonets:vga-1000:-:::::::* cpe:2.3:o:vonets:vap11ac_firmware:::::::: cpe:2.3:o:vonets:vap11g-300_firmware:::::::: cpe:2.3:o:vonets:vap11g-500_firmware:::::::: cpe:2.3:o:vonets:vap11g-500s_firmware:::::::: cpe:2.3:o:vonets:vap11g_firmware:::::::: cpe:2.3:o:vonets:vap11n-300_firmware:::::::: cpe:2.3:o:vonets:vap11s-5g_firmware:::::::: cpe:2.3:o:vonets:vap11s_firmware:::::::: cpe:2.3:o:vonets:var11n-300_firmware:::::::: cpe:2.3:o:vonets:var1200-h_firmware:::::::: cpe:2.3:o:vonets:var1200-l_firmware:::::::: cpe:2.3:o:vonets:var600-h_firmware:::::::: cpe:2.3:o:vonets:vbg1200_firmware:::::::: cpe:2.3:o:vonets:vga-1000_firmware::::::::
Vendors & Products		Vonets vap11ac Vonets vap11g Vonets vap11g-300 Vonets vap11g-500 Vonets vap11g-500 Firmware Vonets vap11g-500s Vonets vap11n-300 Vonets vap11s Vonets vap11s-5g Vonets var11n-300 Vonets var1200-h Vonets var1200-l Vonets var600-h Vonets vbg1200 Vonets vga-1000

Type	Values Removed	Values Added
First Time appeared		Vonets Vonets vap11ac Firmware Vonets vap11g-300 Firmware Vonets vap11g-500s Firmware Vonets vap11g Firmware Vonets vap11n-300 Firmware Vonets vap11s-5g Firmware Vonets vap11s Firmware Vonets var11n-300 Firmware Vonets var1200-h Firmware Vonets var1200-l Firmware Vonets var600-h Firmware Vonets vbg1200 Firmware Vonets vga-1000 Firmware
CPEs		cpe:2.3:a:vonets:vap11ac_firmware:::::::: cpe:2.3:a:vonets:vap11g-300_firmware:::::::: cpe:2.3:a:vonets:vap11g-500s_firmware:::::::: cpe:2.3:a:vonets:vap11g_firmware:::::::: cpe:2.3:a:vonets:vap11n-300_firmware:::::::: cpe:2.3:a:vonets:vap11s-5g_firmware:::::::: cpe:2.3:a:vonets:vap11s_firmware:::::::: cpe:2.3:a:vonets:var11n-300_firmware:::::::: cpe:2.3:a:vonets:var1200-h_firmware:::::::: cpe:2.3:a:vonets:var1200-l_firmware:::::::: cpe:2.3:a:vonets:var600-h_firmware:::::::: cpe:2.3:a:vonets:vbg1200_firmware:::::::: cpe:2.3:a:vonets:vga-1000_firmware::::::::
Vendors & Products		Vonets Vonets vap11ac Firmware Vonets vap11g-300 Firmware Vonets vap11g-500s Firmware Vonets vap11g Firmware Vonets vap11n-300 Firmware Vonets vap11s-5g Firmware Vonets vap11s Firmware Vonets var11n-300 Firmware Vonets var1200-h Firmware Vonets var1200-l Firmware Vonets var600-h Firmware Vonets vbg1200 Firmware Vonets vga-1000 Firmware
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct request when another user has an active session.
Title		Vonets WiFi Bridges Forced Browsing
Weaknesses		CWE-425
References		https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'}` cvssV4_0 `{'score': 6.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42001", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-07-30T16:15:10.118Z", "datePublished": "2024-08-08T19:39:49.024Z", "dateUpdated": "2024-08-21T20:04:53.127Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "VAR1200-H", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAR1200-L", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAR600-H", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAP11AC", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAP11G-500S", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VBG1200", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAP11S-5G", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAP11S", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAR11N-300", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAP11G-300", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAP11N-300", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAP11G", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAP11G-500", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VBG1200", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VAP11AC", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VGA-1000", "vendor": "Vonets", "versions": [{"lessThanOrEqual": "3.3.23.6.9", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Wodzen reported these vulnerabilities to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An improper authentication vulnerability affecting Vonets\n\n\n\n\n\n \n\n industrial wifi bridge relays and wifi bridge repeaters, software versions \n3.3.23.6.9 and prior enables an unauthenticated remote attacker to \nbypass authentication via a specially crafted direct request when \nanother user has an active session."}], "value": "An improper authentication vulnerability affecting Vonets\n\n\n\n\n\n \n\n industrial wifi bridge relays and wifi bridge repeaters, software versions \n3.3.23.6.9 and prior enables an unauthenticated remote attacker to \nbypass authentication via a specially crafted direct request when \nanother user has an active session."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-425", "description": "CWE-425 Forced Browsing", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-08-08T19:39:49.024Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08"}], "source": {"advisory": "ICSA-24-214-08", "discovery": "EXTERNAL"}, "title": "Vonets WiFi Bridges Forced Browsing", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Vonets has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of the affected products are encouraged to \ncontact <a target=\"_blank\" rel=\"nofollow\" href=\"https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/support@vonets.com\">Vonets support</a> for additional information.\n\n<br>"}], "value": "Vonets has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of the affected products are encouraged to \ncontact  Vonets support https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/support@vonets.com  for additional information."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "vonets", "product": "var1200-h_firmware", "cpes": ["cpe:2.3:o:vonets:var1200-h_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "var1200-l_firmware", "cpes": ["cpe:2.3:o:vonets:var1200-l_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "var600-h_firmware", "cpes": ["cpe:2.3:o:vonets:var600-h_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "vap11ac_firmware", "cpes": ["cpe:2.3:o:vonets:vap11ac_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "vap11g-500s_firmware", "cpes": ["cpe:2.3:o:vonets:vap11g-500s_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "vbg1200_firmware", "cpes": ["cpe:2.3:o:vonets:vbg1200_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "vap11s-5g_firmware", "cpes": ["cpe:2.3:o:vonets:vap11s-5g_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "vap11s_firmware", "cpes": ["cpe:2.3:o:vonets:vap11s_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "var11n-300_firmware", "cpes": ["cpe:2.3:o:vonets:var11n-300_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "vap11n-300_firmware", "cpes": ["cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "vap11g_firmware", "cpes": ["cpe:2.3:o:vonets:vap11g_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "vga-1000_firmware", "cpes": ["cpe:2.3:o:vonets:vga-1000_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "vap11g-300_firmware", "cpes": ["cpe:2.3:o:vonets:vap11g-300_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}, {"vendor": "vonets", "product": "vap11n-300_firmware", "cpes": ["cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.23.6.9", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-09T14:41:30.751151Z", "id": "CVE-2024-42001", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T20:04:53.127Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-42001 (string)

assignerOrgId : 7d14cffa-0d7d-4270-9dc0-52cabd5a23a6 (string)

state : PUBLISHED (string)

assignerShortName : icscert (string)

dateReserved : 2024-07-30T16:15:10.118Z (string)

datePublished : 2024-08-08T19:39:49.024Z (string)

dateUpdated : 2024-08-21T20:04:53.127Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : VAR1200-H (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

1 : { »

defaultStatus : unaffected (string)

product : VAR1200-L (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

2 : { »

defaultStatus : unaffected (string)

product : VAR600-H (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

3 : { »

defaultStatus : unaffected (string)

product : VAP11AC (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

4 : { »

defaultStatus : unaffected (string)

product : VAP11G-500S (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

5 : { »

defaultStatus : unaffected (string)

product : VBG1200 (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

6 : { »

defaultStatus : unaffected (string)

product : VAP11S-5G (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

7 : { »

defaultStatus : unaffected (string)

product : VAP11S (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

8 : { »

defaultStatus : unaffected (string)

product : VAR11N-300 (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

9 : { »

defaultStatus : unaffected (string)

product : VAP11G-300 (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

10 : { »

defaultStatus : unaffected (string)

product : VAP11N-300 (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

11 : { »

defaultStatus : unaffected (string)

product : VAP11G (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

12 : { »

defaultStatus : unaffected (string)

product : VAP11G-500 (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

13 : { »

defaultStatus : unaffected (string)

product : VBG1200 (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

14 : { »

defaultStatus : unaffected (string)

product : VAP11AC (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

15 : { »

defaultStatus : unaffected (string)

product : VGA-1000 (string)

vendor : Vonets (string)

versions : [ »

0 : { »

lessThanOrEqual : 3.3.23.6.9 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Wodzen reported these vulnerabilities to CISA. (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct request when another user has an active session. (string)

}

]

value : An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct request when another user has an active session. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.6 (number)

baseSeverity : HIGH (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

1 : { »

cvssV4_0 : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : PRESENT (string)

attackVector : NETWORK (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

subIntegrityImpact : NONE (string)

userInteraction : PASSIVE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N (string)

version : 4.0 (string)

vulnAvailabilityImpact : LOW (string)

vulnConfidentialityImpact : HIGH (string)

vulnIntegrityImpact : LOW (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-425 (string)

description : CWE-425 Forced Browsing (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 7d14cffa-0d7d-4270-9dc0-52cabd5a23a6 (string)

shortName : icscert (string)

dateUpdated : 2024-08-08T19:39:49.024Z (string)

}

references : [ »

0 : { »

url : https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08 (string)

}

]

source : { »

advisory : ICSA-24-214-08 (string)

discovery : EXTERNAL (string)

}

title : Vonets WiFi Bridges Forced Browsing (string)

workarounds : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Vonets has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact <a target="_blank" rel="nofollow" href="https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/support@vonets.com">Vonets support</a> for additional information. <br> (string)

}

]

value : Vonets has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Vonets support https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/support@vonets.com for additional information. (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : vonets (string)

product : var1200-h_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:var1200-h_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : vonets (string)

product : var1200-l_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:var1200-l_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : vonets (string)

product : var600-h_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:var600-h_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

3 : { »

vendor : vonets (string)

product : vap11ac_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:vap11ac_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

4 : { »

vendor : vonets (string)

product : vap11g-500s_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:vap11g-500s_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

5 : { »

vendor : vonets (string)

product : vbg1200_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:vbg1200_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

6 : { »

vendor : vonets (string)

product : vap11s-5g_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:vap11s-5g_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

7 : { »

vendor : vonets (string)

product : vap11s_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:vap11s_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

8 : { »

vendor : vonets (string)

product : var11n-300_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:var11n-300_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

9 : { »

vendor : vonets (string)

product : vap11n-300_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

10 : { »

vendor : vonets (string)

product : vap11g_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:vap11g_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

11 : { »

vendor : vonets (string)

product : vga-1000_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:vga-1000_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

12 : { »

vendor : vonets (string)

product : vap11g-300_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:vap11g-300_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

13 : { »

vendor : vonets (string)

product : vap11n-300_firmware (string)

cpes : [ »

0 : cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 3.3.23.6.9 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-09T14:41:30.751151Z (string)

id : CVE-2024-42001 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-21T20:04:53.127Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42001", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-09T14:41:30.751151Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:vonets:var1200-h_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "var1200-h_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:var1200-l_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "var1200-l_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:var600-h_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "var600-h_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:vap11ac_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "vap11ac_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:vap11g-500s_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "vap11g-500s_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:vbg1200_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "vbg1200_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:vap11s-5g_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "vap11s-5g_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:vap11s_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "vap11s_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:var11n-300_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "var11n-300_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "vap11n-300_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:vap11g_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "vap11g_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:vga-1000_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "vga-1000_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:vap11g-300_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "vap11g-300_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:*"], "vendor": "vonets", "product": "vap11n-300_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-09T14:41:21.390Z"}}], "cna": {"title": "Vonets WiFi Bridges Forced Browsing", "source": {"advisory": "ICSA-24-214-08", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Wodzen reported these vulnerabilities to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Vonets", "product": "VAR1200-H", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAR1200-L", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAR600-H", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAP11AC", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAP11G-500S", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VBG1200", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAP11S-5G", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAP11S", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAR11N-300", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAP11G-300", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAP11N-300", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAP11G", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAP11G-500", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VBG1200", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VAP11AC", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}, {"vendor": "Vonets", "product": "VGA-1000", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.3.23.6.9"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08"}], "workarounds": [{"lang": "en", "value": "Vonets has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of the affected products are encouraged to \ncontact  Vonets support https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/support@vonets.com  for additional information.", "supportingMedia": [{"type": "text/html", "value": "Vonets has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of the affected products are encouraged to \ncontact <a target=\"_blank\" rel=\"nofollow\" href=\"https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/support@vonets.com\">Vonets support</a> for additional information.\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An improper authentication vulnerability affecting Vonets\n\n\n\n\n\n \n\n industrial wifi bridge relays and wifi bridge repeaters, software versions \n3.3.23.6.9 and prior enables an unauthenticated remote attacker to \nbypass authentication via a specially crafted direct request when \nanother user has an active session.", "supportingMedia": [{"type": "text/html", "value": "An improper authentication vulnerability affecting Vonets\n\n\n\n\n\n \n\n industrial wifi bridge relays and wifi bridge repeaters, software versions \n3.3.23.6.9 and prior enables an unauthenticated remote attacker to \nbypass authentication via a specially crafted direct request when \nanother user has an active session.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-425", "description": "CWE-425 Forced Browsing"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-08-08T19:39:49.024Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42001", "state": "PUBLISHED", "dateUpdated": "2024-08-21T20:04:53.127Z", "dateReserved": "2024-07-30T16:15:10.118Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2024-08-08T19:39:49.024Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-42001 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-09T14:41:30.751151Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:var1200-h_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : var1200-h_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

1 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:var1200-l_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : var1200-l_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

2 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:var600-h_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : var600-h_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

3 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:vap11ac_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : vap11ac_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

4 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:vap11g-500s_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : vap11g-500s_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

5 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:vbg1200_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : vbg1200_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

6 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:vap11s-5g_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : vap11s-5g_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

7 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:vap11s_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : vap11s_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

8 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:var11n-300_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : var11n-300_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

9 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : vap11n-300_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

10 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:vap11g_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : vap11g_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

11 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:vga-1000_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : vga-1000_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

12 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:vap11g-300_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : vap11g-300_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

13 : { »

cpes : [ »

0 : cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:* (string)

]

vendor : vonets (string)

product : vap11n-300_firmware (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-09T14:41:21.390Z (string)

}

]

cna : { »

title : Vonets WiFi Bridges Forced Browsing (string)

source : { »

advisory : ICSA-24-214-08 (string)

discovery : EXTERNAL (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Wodzen reported these vulnerabilities to CISA. (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.6 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

1 : { »

format : CVSS (string)

cvssV4_0 : { »

Safety : NOT_DEFINED (string)

version : 4.0 (string)

Recovery : NOT_DEFINED (string)

baseScore : 6.1 (number)

Automatable : NOT_DEFINED (string)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N (string)

providerUrgency : NOT_DEFINED (string)

userInteraction : PASSIVE (string)

attackComplexity : LOW (string)

attackRequirements : PRESENT (string)

privilegesRequired : NONE (string)

subIntegrityImpact : NONE (string)

vulnIntegrityImpact : LOW (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : LOW (string)

subConfidentialityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Vonets (string)

product : VAR1200-H (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

1 : { »

vendor : Vonets (string)

product : VAR1200-L (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

2 : { »

vendor : Vonets (string)

product : VAR600-H (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

3 : { »

vendor : Vonets (string)

product : VAP11AC (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

4 : { »

vendor : Vonets (string)

product : VAP11G-500S (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

5 : { »

vendor : Vonets (string)

product : VBG1200 (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

6 : { »

vendor : Vonets (string)

product : VAP11S-5G (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

7 : { »

vendor : Vonets (string)

product : VAP11S (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

8 : { »

vendor : Vonets (string)

product : VAR11N-300 (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

9 : { »

vendor : Vonets (string)

product : VAP11G-300 (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

10 : { »

vendor : Vonets (string)

product : VAP11N-300 (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

11 : { »

vendor : Vonets (string)

product : VAP11G (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

12 : { »

vendor : Vonets (string)

product : VAP11G-500 (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

13 : { »

vendor : Vonets (string)

product : VBG1200 (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

14 : { »

vendor : Vonets (string)

product : VAP11AC (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

15 : { »

vendor : Vonets (string)

product : VGA-1000 (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 3.3.23.6.9 (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08 (string)

}

]

workarounds : [ »

0 : { »

lang : en (string)

value : Vonets has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Vonets support https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/support@vonets.com for additional information. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Vonets has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact <a target="_blank" rel="nofollow" href="https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/support@vonets.com">Vonets support</a> for additional information. <br> (string)

base64 : false (boolean)

}

]

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct request when another user has an active session. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct request when another user has an active session. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-425 (string)

description : CWE-425 Forced Browsing (string)

}

]

}

]

providerMetadata : { »

orgId : 7d14cffa-0d7d-4270-9dc0-52cabd5a23a6 (string)

shortName : icscert (string)

dateUpdated : 2024-08-08T19:39:49.024Z (string)

}

cveMetadata : { »

cveId : CVE-2024-42001 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-21T20:04:53.127Z (string)

dateReserved : 2024-07-30T16:15:10.118Z (string)

assignerOrgId : 7d14cffa-0d7d-4270-9dc0-52cabd5a23a6 (string)

datePublished : 2024-08-08T19:39:49.024Z (string)

assignerShortName : icscert (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:var1200-h_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "94DAF720-5399-46A2-A9AB-3831045B86D2", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:var1200-h:-:*:*:*:*:*:*:*", "matchCriteriaId": "6D2E3C6A-6CC6-4954-B06C-3F023C964426", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:var1200-l_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "273874D4-43E0-44D4-AB4E-D66DE1F1B824", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:var1200-l:-:*:*:*:*:*:*:*", "matchCriteriaId": "2C4B65A1-D625-4712-8311-685CA0A6438B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:var600-h_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADCC4730-7801-485C-994F-DB7B942AA9F4", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:var600-h:-:*:*:*:*:*:*:*", "matchCriteriaId": "DB22B21B-526A-4119-9278-E84138D523E4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:vap11ac_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C007C620-CAF2-436E-AAA9-C012CEFCEA3B", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:vap11ac:-:*:*:*:*:*:*:*", "matchCriteriaId": "21B9AA55-A333-4D10-A9D8-19558465F56E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:vap11g-500s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDC4DF91-B718-4CFE-BEE7-4E9CFF121C01", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:vap11g-500s:-:*:*:*:*:*:*:*", "matchCriteriaId": "C9EC2642-6A5B-4DA8-A675-B9F3CAD9B35E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:vbg1200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5BFA8106-50EE-428D-9297-930CE9CC99C1", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:vbg1200:-:*:*:*:*:*:*:*", "matchCriteriaId": "AE4D6B12-50A8-4314-AEDA-E3C669F772C9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:vap11s-5g_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D95A2EE8-B22F-4671-8DF8-3757A335B006", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:vap11s-5g:-:*:*:*:*:*:*:*", "matchCriteriaId": "66E94FE6-235A-46F0-81B0-DFF88C454BB1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:vap11s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "060B7C85-806D-45B3-8268-10AC5E475171", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:vap11s:-:*:*:*:*:*:*:*", "matchCriteriaId": "C434D025-8361-4C2D-AC7D-4E4A44237C27", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:var11n-300_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3DFA50C3-2B3E-4755-98FB-63CED2CA7B8F", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:var11n-300:-:*:*:*:*:*:*:*", "matchCriteriaId": "95D5A3C0-8303-4E77-9DE1-75FD9DAED295", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:vap11g-300_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "42E71F95-814C-4EDA-8647-B03CA6AAFDEB", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:vap11g-300:-:*:*:*:*:*:*:*", "matchCriteriaId": "2B23375E-0E77-4423-AEDA-9A9F26052834", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7018E246-D211-4366-8664-90B00E68AA74", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:vap11n-300:-:*:*:*:*:*:*:*", "matchCriteriaId": "ADE0116E-37B8-4E0A-8874-A59989712743", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:vap11g_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9C1B20A-8F03-4C6E-8715-B68DBBBAFB97", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:vap11g:-:*:*:*:*:*:*:*", "matchCriteriaId": "F510F0DC-C170-45A3-989B-2FA8791B4FC1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:vap11g-500_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "52909496-4BEB-43DB-80E3-F710BCA0CAA5", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:vap11g-500:-:*:*:*:*:*:*:*", "matchCriteriaId": "B61E3489-034E-4DD2-8699-477647462CF7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:vonets:vga-1000_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1FAF11BE-F3F4-4D40-9156-DDB2FFBF9470", "versionEndIncluding": "3.3.23.6.9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:vonets:vga-1000:-:*:*:*:*:*:*:*", "matchCriteriaId": "DA90833B-D40E-42F0-8ECF-86C90E4511C4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper authentication vulnerability affecting Vonets\n\n\n\n\n\n \n\n industrial wifi bridge relays and wifi bridge repeaters, software versions \n3.3.23.6.9 and prior enables an unauthenticated remote attacker to \nbypass authentication via a specially crafted direct request when \nanother user has an active session."}, {"lang": "es", "value": "Una vulnerabilidad de autenticaci\u00f3n inadecuada que afecta a los rel\u00e9s de puente wifi industriales y a los repetidores de puente wifi de Vonets, versiones de software 3.3.23.6.9 y anteriores, permite a un atacante remoto no autenticado evitar la autenticaci\u00f3n a trav\u00e9s de una solicitud directa especialmente manipulada cuando otro usuario tiene una sesi\u00f3n activa."}], "id": "CVE-2024-42001", "lastModified": "2024-08-20T16:37:05.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "LOW", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "LOW"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2024-08-12T13:38:32.140", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-425"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:var1200-h_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 94DAF720-5399-46A2-A9AB-3831045B86D2 (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:var1200-h:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 6D2E3C6A-6CC6-4954-B06C-3F023C964426 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:var1200-l_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 273874D4-43E0-44D4-AB4E-D66DE1F1B824 (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:var1200-l:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 2C4B65A1-D625-4712-8311-685CA0A6438B (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:var600-h_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : ADCC4730-7801-485C-994F-DB7B942AA9F4 (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:var600-h:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DB22B21B-526A-4119-9278-E84138D523E4 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

3 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:vap11ac_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : C007C620-CAF2-436E-AAA9-C012CEFCEA3B (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:vap11ac:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 21B9AA55-A333-4D10-A9D8-19558465F56E (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

4 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:vap11g-500s_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : FDC4DF91-B718-4CFE-BEE7-4E9CFF121C01 (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:vap11g-500s:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C9EC2642-6A5B-4DA8-A675-B9F3CAD9B35E (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

5 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:vbg1200_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 5BFA8106-50EE-428D-9297-930CE9CC99C1 (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:vbg1200:-:*:*:*:*:*:*:* (string)

matchCriteriaId : AE4D6B12-50A8-4314-AEDA-E3C669F772C9 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

6 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:vap11s-5g_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D95A2EE8-B22F-4671-8DF8-3757A335B006 (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:vap11s-5g:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 66E94FE6-235A-46F0-81B0-DFF88C454BB1 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

7 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:vap11s_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 060B7C85-806D-45B3-8268-10AC5E475171 (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:vap11s:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C434D025-8361-4C2D-AC7D-4E4A44237C27 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

8 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:var11n-300_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 3DFA50C3-2B3E-4755-98FB-63CED2CA7B8F (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:var11n-300:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 95D5A3C0-8303-4E77-9DE1-75FD9DAED295 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

9 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:vap11g-300_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 42E71F95-814C-4EDA-8647-B03CA6AAFDEB (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:vap11g-300:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 2B23375E-0E77-4423-AEDA-9A9F26052834 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

10 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 7018E246-D211-4366-8664-90B00E68AA74 (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:vap11n-300:-:*:*:*:*:*:*:* (string)

matchCriteriaId : ADE0116E-37B8-4E0A-8874-A59989712743 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

11 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:vap11g_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : C9C1B20A-8F03-4C6E-8715-B68DBBBAFB97 (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:vap11g:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F510F0DC-C170-45A3-989B-2FA8791B4FC1 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

12 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:vap11g-500_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 52909496-4BEB-43DB-80E3-F710BCA0CAA5 (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:vap11g-500:-:*:*:*:*:*:*:* (string)

matchCriteriaId : B61E3489-034E-4DD2-8699-477647462CF7 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

13 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:vonets:vga-1000_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1FAF11BE-F3F4-4D40-9156-DDB2FFBF9470 (string)

versionEndIncluding : 3.3.23.6.9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:vonets:vga-1000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DA90833B-D40E-42F0-8ECF-86C90E4511C4 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct request when another user has an active session. (string)

}

1 : { »

lang : es (string)

value : Una vulnerabilidad de autenticación inadecuada que afecta a los relés de puente wifi industriales y a los repetidores de puente wifi de Vonets, versiones de software 3.3.23.6.9 y anteriores, permite a un atacante remoto no autenticado evitar la autenticación a través de una solicitud directa especialmente manipulada cuando otro usuario tiene una sesión activa. (string)

}

]

id : CVE-2024-42001 (string)

lastModified : 2024-08-20T16:37:05.447 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.6 (number)

baseSeverity : HIGH (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 4.7 (number)

source : ics-cert@hq.dhs.gov (string)

type : Secondary (string)

}

]

cvssMetricV40 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackRequirements : PRESENT (string)

attackVector : NETWORK (string)

automatable : NOT_DEFINED (string)

availabilityRequirements : NOT_DEFINED (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityRequirements : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirements : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubsequentSystemAvailability : NOT_DEFINED (string)

modifiedSubsequentSystemConfidentiality : NOT_DEFINED (string)

modifiedSubsequentSystemIntegrity : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnerableSystemAvailability : NOT_DEFINED (string)

modifiedVulnerableSystemConfidentiality : NOT_DEFINED (string)

modifiedVulnerableSystemIntegrity : NOT_DEFINED (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

recovery : NOT_DEFINED (string)

safety : NOT_DEFINED (string)

subsequentSystemAvailability : NONE (string)

subsequentSystemConfidentiality : NONE (string)

subsequentSystemIntegrity : NONE (string)

userInteraction : PASSIVE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

vulnerableSystemAvailability : LOW (string)

vulnerableSystemConfidentiality : HIGH (string)

vulnerableSystemIntegrity : LOW (string)

}

source : ics-cert@hq.dhs.gov (string)

type : Secondary (string)

}

]

}

published : 2024-08-12T13:38:32.140 (string)

references : [ »

0 : { »

source : ics-cert@hq.dhs.gov (string)

tags : [ »

0 : Third Party Advisory (string)

1 : US Government Resource (string)

]

url : https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08 (string)

}

]

sourceIdentifier : ics-cert@hq.dhs.gov (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-425 (string)

}

]

source : ics-cert@hq.dhs.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object