CVE-2024-10381
Authentication Bypass Using an Alternate Path or Channel (CWE-288)
Summary
A vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management at the web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable device.
Impact
Successful exploitation of this vulnerability could allow a remote attacker to gain unauthorized access and take complete control of the targeted device. This includes potential impacts on the confidentiality, integrity, and availability of the system, all rated as HIGH. The CVSS v3.1 base score is 9.8 (CRITICAL), indicating severe consequences. The attack vector is NETWORK, attack complexity is LOW, and no user interaction is required, making it easily exploitable. There may also be LOW impacts on subsequent systems' confidentiality, integrity, and availability.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is not currently available for this vulnerability. The vulnerability affects Matrix Door Controller Cosec Vega FAXQ firmware versions prior to v2r17.
Mitigation
While specific mitigation steps are not provided, general recommendations include: 1. Implement strong access controls and authentication mechanisms for the web-based management interface. 2. Use network segmentation to limit access to the Matrix Door Controller Cosec Vega FAXQ devices. 3. Monitor and log all access attempts to these devices. 4. Apply any security updates or patches as soon as they become available from the vendor. 5. Consider using a web application firewall (WAF) to help protect against malicious HTTP requests. 6. If possible, disable or restrict access to the web-based management interface until a patch is available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
NVD published the first details for CVE-2024-10381
A CVSS base score of 9.3 has been assigned.
Feedly found the first article mentioning CVE-2024-10381. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 9.8%)