CVE-2024-38280
published 2024-06-13CVE-2024-38280: An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is…
PriorityP419medium4.6CVSS 3.1
AVPACLPRNUINSUCHINAN
EPSS
0.15%
4.6th percentile
An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| motorola | vigilant_fixed_lpr_coms_box_firmware | <= 3.1.171.9 | — |
| motorola_solutions | vigilant_fixed_lpr_coms_box | <= 3.1.171.9 | — |
CVSS provenance
nvdv3.14.6MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.07.0HIGHCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Motorola Solutions Vigilant License Plate Readers
cisa_ics·2024-06-13·CVSS 5.1
[MEDIUM] Motorola Solutions Vigilant License Plate Readers
ICS Advisory
##
Motorola Solutions Vigilant License Plate Readers
Release DateJune 13, 2024
Alert CodeICSA-24-165-19
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Motorola Solutions
- Equipment: Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
- Vulnerabilities: Authentication Bypass Using an Alternate Path or Channel, Cleartext Storage in a File or on Disk, Use of Hard-coded Credentials, Insufficiently Protected Credentials, Missing Encryption of Sensitive Data, Authentication Bypass by Capture-replay
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to tamper wi
GHSA
GHSA-jm3x-qp4q-p8jr: An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the dat
ghsa_unreviewed·2024-06-13
CVE-2024-38280 [HIGH] CWE-312 GHSA-jm3x-qp4q-p8jr: An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the dat
An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-06-13
Published