CVE-2024-29082 Vonets WiFi Bridges Improper Access Control
Unauthenticated remote attackers can bypass authentication and factory reset Vonets industrial WiFi bridges via unprotected endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-29082?
CVE-2024-29082 is a high-severity missing authorization vulnerability in Vonets VAP11AC, published on 8 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper access control vulnerability affecting Vonets
industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to bypass authentication and factory reset the device via unprotected goform endpoints.
Weakness: CWE-284
Which versions are affected by CVE-2024-29082?
It affects 14 products.
Products include Vonets Vap11ac Firmware, Vonets Vap11g-300 Firmware, Vonets Vap11g-500 Firmware, Vonets Vap11g-500s Firmware, Vonets Vap11g Firmware, Vonets Vap11n-300 Firmware and 8 more.
How do I fix CVE-2024-29082?
No fix has been published for CVE-2024-29082 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-29082 being exploited?
There is no known exploitation of CVE-2024-29082 in the wild and no public exploit code.
Other vulnerabilities in Vonets VAP11AC
- CVE-2024-39791 Vonets WiFi Bridges Stack-based Buffer Overflow
- CVE-2024-37023 Vonets WiFi Bridges Command Injection
- CVE-2024-39815 Vonets WiFi Bridges Improper Check or Handling of Exceptional Conditions
- CVE-2024-41161 Vonets WiFi Bridges Use of Hard-coded Credentials
- CVE-2024-41936 Vonets WiFi Bridges Path Traversal
Sources
Also known as GHSA-fx2m-xj8m-g5xr.