CVE-2024-40087

Missing Authentication for Critical Function (CWE-306)

Published: Oct 21, 2024 / Updated: 29d ago

010
CVSS 9.6EPSS 0.04%Critical
CVE info copied to clipboard

Summary

Vilo 5 Mesh WiFi System versions 5.16.1.33 and earlier contain a critical vulnerability due to insecure permissions. The custom TCP service on port 5432 lacks proper authentication, allowing remote, unauthenticated attackers to gain administrative access over the router.

Impact

This vulnerability has severe potential impacts: 1. Unauthorized Administrative Access: Attackers can gain full administrative control over the affected routers, potentially compromising the entire network. 2. Network Compromise: With administrative access, attackers could modify router configurations, intercept network traffic, or use the router as a pivot point for further attacks on connected devices. 3. Data Breach: The high confidentiality impact suggests that sensitive information passing through the router could be exposed. 4. Service Disruption: The high availability impact indicates that attackers could potentially disrupt network services or render the router inoperable. 5. Lateral Movement: Given the "Changed" scope, the impact may extend beyond the vulnerable component, potentially affecting other connected systems or the broader network infrastructure.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the reported date, there is no mention of an available patch. The vulnerability affects Vilo 5 Mesh WiFi System versions 5.16.1.33 and earlier. Users should check for and apply any security updates released by Vilo as soon as they become available.

Mitigation

Until a patch is available, consider the following mitigation strategies: 1. Network Segmentation: Isolate affected Vilo 5 Mesh WiFi Systems from critical network segments. 2. Access Control: Implement strict network access controls to limit potential attackers' ability to reach the vulnerable TCP service on port 5432. 3. Firewall Rules: Configure firewalls to block external access to port 5432 on affected devices. 4. Monitoring: Implement enhanced monitoring for any suspicious activities or unauthorized access attempts on the affected routers. 5. Update: Regularly check for and apply any security updates or patches released by Vilo. 6. Alternative Solutions: If possible, consider using alternative, non-vulnerable networking equipment in critical environments until a patch is available. 7. Least Privilege: Ensure all network devices and services operate on the principle of least privilege to minimize potential damage if a device is compromised.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-40087

Oct 21, 2024 at 9:15 PM
First Article

Feedly found the first article mentioning CVE-2024-40087. See article

Oct 21, 2024 at 9:21 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 21, 2024 at 9:21 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.7%)

Oct 22, 2024 at 10:46 AM
CVSS

A CVSS base score of 9.6 has been assigned.

Oct 22, 2024 at 5:40 PM / nvd
Static CVE Timeline Graph

Attack Patterns

CAPEC-12: Choosing Message Identifier
+null more

News

CVE-2024-40087 | Vilo Mesh WiFi System up to 5.16.1.33 TCP Service Port 5432 Remote Code Execution
A vulnerability has been found in Vilo Mesh WiFi System up to 5.16.1.33 and classified as very critical . This vulnerability affects unknown code of the component TCP Service Port 5432 . The manipulation leads to Remote Code Execution. This vulnerability was named CVE-2024-40087 . The attack can be initiated remotely. There is no exploit available. It is recommended to apply restrictive firewalling.
CVE-2024-40087
Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the...
CVE-2024-40087
Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the...
CVE-2024-40087 - Vilo 5 Mesh WiFi System Unauthenticated Remote Administrative Access Vulnerability
CVE ID : CVE-2024-40087 Published : Oct. 21, 2024, 9:15 p.m. 18 minutes ago Description : Vilo 5 Mesh WiFi System Severity: 0.0 NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2024-40087
Vilo 5 Mesh WiFi System <=5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router.

CVSS V3.1

Attack Vector:Adjacent_network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Changed
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI