CVE-2024-38279
published 2024-06-13CVE-2024-38279: The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file…
PriorityP423medium4.6CVSS 3.1
AVPACLPRNUINSUCHINAN
EPSS
0.25%
16.4th percentile
The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| motorola | vigilant_fixed_lpr_coms_box_firmware | <= 3.1.171.9 | — |
| motorola_solutions | vigilant_fixed_lpr_coms_box | <= 3.1.171.9 | — |
CVSS provenance
nvdv3.14.6MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Motorola Solutions Vigilant License Plate Readers
cisa_ics·2024-06-13·CVSS 5.1
[MEDIUM] Motorola Solutions Vigilant License Plate Readers
ICS Advisory
##
Motorola Solutions Vigilant License Plate Readers
Release DateJune 13, 2024
Alert CodeICSA-24-165-19
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Motorola Solutions
- Equipment: Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
- Vulnerabilities: Authentication Bypass Using an Alternate Path or Channel, Cleartext Storage in a File or on Disk, Use of Hard-coded Credentials, Insufficiently Protected Credentials, Missing Encryption of Sensitive Data, Authentication Bypass by Capture-replay
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to tamper wi
GHSA
GHSA-qcm6-ww7j-hm8x: The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the f
ghsa_unreviewed·2024-06-13
CVE-2024-38279 [MEDIUM] CWE-288 GHSA-qcm6-ww7j-hm8x: The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the f
The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-06-13
Published