CVE-2024-39771 Security feature bypass in QBiC CLOUD CC-2L
Attackers can intercept and modify communications via man-in-the-middle attacks due to improper certificate validation in QBiC and Safie devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-39771?
CVE-2024-39771 is a medium-severity vulnerability in Safie Inc. QBiC CLOUD CC-2L, published on 28 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
QBiC CLOUD CC-2L v1.1.30 and earlier and Safie One v1.8.2 and earlier do not properly validate certificates, which may allow a network-adjacent unauthenticated attacker to obtain and/or alter communications of the affected product via a man-in-the-middle attack.
Weakness: CWE-295
Which versions are affected by CVE-2024-39771?
It affects 2 products.
Products include Safie Qbic Cloud Cc-2\/2l Firmware, Safie Safie One Firmware.
How do I fix CVE-2024-39771?
No fix has been published for CVE-2024-39771 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-39771 being exploited?
There is no known exploitation of CVE-2024-39771 in the wild and no public exploit code.
Sources
Also known as CVE-2024-41718, GHSA-v66p-q797-c8vm.