CVE-2024-40116 Information disclosure in n/a
Attackers can read plaintext passwords from exported HTML files in Solar-Log 1000 devices, compromising user credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-40116?
CVE-2024-40116 is a high-severity vulnerability in n/a, published on 26 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files -- fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
Weakness: CWE-256
Which versions are affected by CVE-2024-40116?
How do I fix CVE-2024-40116?
No fix has been published for CVE-2024-40116 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-40116 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-40116 exists.
Sources
Also known as GHSA-mjh6-hm62-6x3r.