CVE-2024-2413 Intumit SmartRobot - Use of Hard-coded Cryptographic Key
Remote attackers can use a hard-coded cryptographic key to gain administrator privileges and execute arbitrary code on the Intumit SmartRobot server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2413?
CVE-2024-2413 is a critical vulnerability in Intumit SmartRobot, published on 13 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timestamp to generate an authentication code. With this authentication code, they can obtain administrator privileges and subsequently execute arbitrary code on the remote server using built-in system functionality.
Weakness: CWE-321
Which versions are affected by CVE-2024-2413?
It affects 1 product.
Products include Intumit Smartrobot.
How do I fix CVE-2024-2413?
No fix has been published for CVE-2024-2413 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-2413 being exploited?
There is no known exploitation of CVE-2024-2413 in the wild and no public exploit code.
Other vulnerabilities in Intumit SmartRobot
- CVE-2024-0552 Intumit inc. SmartRobot - Remote Code Execution
- CVE-2024-12652 Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection')
- CVE-2025-3572 INTUMIT SmartRobot - Server-Side Request Forgery
- CVE-2024-8776 INTUMIT SmartRobot - Cross-site Scripting
Sources
Also known as GHSA-gpg3-v7vj-4v8w.