CVE-2024-39364

Missing Authentication for Critical Function (CWE-306)

Published: Sep 27, 2024 / Updated: 53d ago

010
CVSS 7EPSS 0.04%High
CVE info copied to clipboard

Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, rebooting the hardware, and stopping the execution. The commands can be sent to a simple HTTP request and are executed by the device automatically, without discrimination of origin or level of privileges of the user sending the commands.

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-39364. See article

Sep 26, 2024 at 2:41 PM / All CISA Advisories
Threat Intelligence Report

CVE-2024-39364 is a vulnerability with a CVSS v4 base score of 8.3, indicating a significant level of criticality. The CVSS vector string suggests that it has a low attack complexity and requires user interaction for exploitation. The provided information does not specify whether the vulnerability is being exploited in the wild, nor does it mention any proof-of-concept exploits, mitigations, detections, patches, or downstream impacts on third-party vendors or technology. See article

Sep 26, 2024 at 2:41 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 27, 2024 at 5:59 PM
CVE Assignment

NVD published the first details for CVE-2024-39364

Sep 27, 2024 at 6:15 PM
CVSS

A CVSS base score of 6.3 has been assigned.

Sep 27, 2024 at 6:20 PM / nvd
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.6%)

Sep 28, 2024 at 9:21 AM
Static CVE Timeline Graph

Affected Systems

Advantech
+null more

Attack Patterns

CAPEC-12: Choosing Message Identifier
+null more

References

Advantech ADAM-5630
Successful exploitation of this vulnerability could allow an attacker to hijack a legitimate user's session, perform cross-site request forgery, or cause a denial-of-service condition. CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:

News

Vulnerabilities –  Advantech ADAM-5630
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Cross-site request forgery (CSRF) is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to perform.
CVE-2024-39364
Medium Severity Description Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, rebooting the hardware, and stopping the execution. The commands can be sent to a simple HTTP request and are executed by the device automatically, without discrimination of origin or level of privileges of the user sending the commands. Read more at https://www.tenable.com/cve/CVE-2024-39364
CVE-2024-39364
has built-in commands that can be executed without authenticating the of the user sending the commands.
NA - CVE-2024-39364 - Advantech ADAM-5630 has built-in commands that...
Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, rebooting the hardware, and stopping the...
CVE-2024-39364 | Advantech ADAM-5630 up to 2.5.1 HTTP Request missing authentication (icsa-24-270-02)
A vulnerability was found in Advantech ADAM-5630 up to 2.5.1 . It has been classified as critical . This affects an unknown part of the component HTTP Request Handler . The manipulation leads to missing authentication. This vulnerability is uniquely identified as CVE-2024-39364 . The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.
See 8 more articles and social media posts

CVSS V3.1

Attack Vector:Adjacent_network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:None
Integrity:Low
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI