CVE-2024-39220 Information disclosure in n/a
Authenticated attackers can read SIP account passwords via a crafted GET request in BAS-IP video intercom devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-39220?
CVE-2024-39220 is a medium-severity vulnerability in n/a, published on 3 Jul 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request.
Weakness: CWE-256
Which versions are affected by CVE-2024-39220?
How do I fix CVE-2024-39220?
No fix has been published for CVE-2024-39220 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-39220 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39220 exists.
Sources
Also known as GHSA-pxvx-mm2m-59v4.