CVE-2024-45841 Information disclosure in UD-LT1
A guest user can access a specific file to obtain credentials, leading to information disclosure in I-O DATA UD-LT1 devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45841?
CVE-2024-45841 is a medium-severity vulnerability in I-O DATA DEVICE, INC. UD-LT1, published on 5 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incorrect permission assignment for critical resource issue exists in UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier. If an attacker with the guest account of the affected products accesses a specific file, the information containing credentials may be obtained.
Weakness: CWE-732
Which versions are affected by CVE-2024-45841?
How do I fix CVE-2024-45841?
No fix has been published for CVE-2024-45841 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-45841 being exploited?
There is no known exploitation of CVE-2024-45841 in the wild and no public exploit code.
Sources
Also known as GHSA-wfqf-8h9w-jx73.