Missing Authentication for Critical Function (CWE-306)
A missing authentication vulnerability exists in the Telnet function of WAB-I1750-PS v1.5.10 and earlier. When the Telnet function of the product is enabled, a remote attacker can login to the product without authentication and alter the product's settings.
This vulnerability allows remote attackers to gain unauthorized access to the affected system without any authentication. Once accessed, the attacker can modify the product's settings, potentially leading to: 1. Unauthorized configuration changes 2. Compromise of system integrity 3. Disruption of normal operations 4. Potential gateway for further attacks on the network The CVSS v3.1 base score is 3.7 (Low), with low impact on integrity, and no impact on confidentiality and availability. However, the severity of this vulnerability should not be underestimated, as it provides a direct path for attackers to access and modify critical system settings.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. According to the vulnerability data, there is a patch detail with a URL: https://www.elecom.co.jp/news/security/20240827-01/. The patch was added on 2024-09-03. The vulnerability affects WAB-I1750-PS v1.5.10 and earlier versions, suggesting that an update beyond v1.5.10 might be required to address this issue.
Until the patch can be applied, consider the following mitigation strategies: 1. Disable the Telnet function if it's not critically needed. 2. If Telnet must be used, implement strong network segmentation to limit access to the affected devices. 3. Use firewalls or access control lists to restrict Telnet access to only trusted IP addresses. 4. Monitor for any unauthorized access attempts or configuration changes. 5. Consider using alternative, more secure remote access methods like SSH if supported by the device. 6. Regularly audit device configurations and access logs for any suspicious activities. After implementing these mitigations, prioritize applying the available patch as soon as possible to fully address the vulnerability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Feedly found the first article mentioning CVE-2024-39300. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-39300
A CVSS base score of 8.1 has been assigned.
EPSS Score was set to: 0.04% (Percentile: 9.5%)
A CVSS base score of 3.7 has been assigned.