{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8889", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2024-09-16T10:20:30.893Z", "datePublished": "2024-09-18T12:00:11.071Z", "dateUpdated": "2024-09-18T13:09:03.920Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CIRCUTOR TCP2RS+", "vendor": "CIRCUTOR", "versions": [{"status": "affected", "version": "1.3b", "versionType": "firmware"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Aar\u00f3n Flecha"}, {"lang": "en", "type": "finder", "value": "Javier Fernandez Ber\u00e9"}, {"lang": "en", "type": "finder", "value": "V\u00edctor Bello Cuevas"}], "datePublic": "2024-09-16T10:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle."}], "value": "Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2024-09-18T12:00:11.071Z"}, "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "CIRCUTOR TCP2RS+ device firmware version 1.3.b (2017), presents 2 security vulnerabilities exploitable mainly in public communication networks, especially in networks not adequately protected. CIRCUTOR strongly recommends replacing the TCP2RS+ device with the current Line-TCPRS1, both in private and public network environments."}], "value": "CIRCUTOR TCP2RS+ device firmware version 1.3.b (2017), presents 2 security vulnerabilities exploitable mainly in public communication networks, especially in networks not adequately protected. CIRCUTOR strongly recommends replacing the TCP2RS+ device with the current Line-TCPRS1, both in private and public network environments."}], "source": {"discovery": "EXTERNAL"}, "title": "Improper Input Validation vulnerability on CIRCUTOR TCP2RS+", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "circutor", "product": "circutor_tcp2rs_plus", "cpes": ["cpe:2.3:a:circutor:circutor_tcp2rs_plus:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.3b", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-18T13:02:10.649196Z", "id": "CVE-2024-8889", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-18T13:09:03.920Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8889", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-18T13:02:10.649196Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:circutor:circutor_tcp2rs_plus:*:*:*:*:*:*:*:*"], "vendor": "circutor", "product": "circutor_tcp2rs_plus", "versions": [{"status": "affected", "version": "1.3b"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-18T13:07:51.938Z"}}], "cna": {"title": "Improper Input Validation vulnerability on CIRCUTOR TCP2RS+", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Aar\u00f3n Flecha"}, {"lang": "en", "type": "finder", "value": "Javier Fernandez Ber\u00e9"}, {"lang": "en", "type": "finder", "value": "V\u00edctor Bello Cuevas"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "CIRCUTOR", "product": "CIRCUTOR TCP2RS+", "versions": [{"status": "affected", "version": "1.3b", "versionType": "firmware"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "CIRCUTOR TCP2RS+ device firmware version 1.3.b (2017), presents 2 security vulnerabilities exploitable mainly in public communication networks, especially in networks not adequately protected. CIRCUTOR strongly recommends replacing the TCP2RS+ device with the current Line-TCPRS1, both in private and public network environments.", "supportingMedia": [{"type": "text/html", "value": "CIRCUTOR TCP2RS+ device firmware version 1.3.b (2017), presents 2 security vulnerabilities exploitable mainly in public communication networks, especially in networks not adequately protected. CIRCUTOR strongly recommends replacing the TCP2RS+ device with the current Line-TCPRS1, both in private and public network environments.", "base64": false}]}], "datePublic": "2024-09-16T10:00:00.000Z", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle.", "supportingMedia": [{"type": "text/html", "value": "Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2024-09-18T12:00:11.071Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8889", "state": "PUBLISHED", "dateUpdated": "2024-09-18T13:09:03.920Z", "dateReserved": "2024-09-16T10:20:30.893Z", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "datePublished": "2024-09-18T12:00:11.071Z", "assignerShortName": "INCIBE"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:circutor:tcp2rs\\+_firmware:1.3b:*:*:*:*:*:*:*", "matchCriteriaId": "522FE1C3-3EED-4EC0-B946-5ACD71ACF6DB", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:circutor:tcp2rs\\+:-:*:*:*:*:*:*:*", "matchCriteriaId": "D3A95ECE-C9F7-477A-862E-EEFA050D4FE0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle."}, {"lang": "es", "value": "Vulnerabilidad en la versi\u00f3n de firmware 1.3b de CIRCUTOR TCP2RS+, que podr\u00eda permitir a un atacante modificar cualquier valor de configuraci\u00f3n, incluso si el equipo tiene habilitada la opci\u00f3n de autenticaci\u00f3n de usuario/contrase\u00f1a, sin autenticaci\u00f3n mediante el env\u00edo de paquetes a trav\u00e9s del protocolo UDP y el puerto 2000, desconfigurando el equipo y deshabilitando as\u00ed su uso. Este equipo se encuentra al final de su ciclo de vida \u00fatil."}], "id": "CVE-2024-8889", "lastModified": "2024-10-07T17:09:27.603", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "cve-coordination@incibe.es", "type": "Secondary"}]}, "published": "2024-09-18T12:15:03.710", "references": [{"source": "cve-coordination@incibe.es", "tags": ["Third Party Advisory"], "url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products"}], "sourceIdentifier": "cve-coordination@incibe.es", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "cve-coordination@incibe.es", "type": "Secondary"}]}

{}