CVE-2024-8887 Authentication bypass vulnerability on CIRCUTOR Q-SMT
Attackers can bypass web login to access device functionalities, potentially causing denial of service on CIRCUTOR Q-SMT devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8887?
CVE-2024-8887 is a critical authentication bypass vulnerability in CIRCUTOR Q-SMT, published on 18 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow interacting with the device.
Weakness: CWE-1284
Which versions are affected by CVE-2024-8887?
It affects 1 product.
Products include Circutor Q-Smt Firmware.
How do I fix CVE-2024-8887?
No fix has been published for CVE-2024-8887 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-8887 being exploited?
There is no known exploitation of CVE-2024-8887 in the wild and no public exploit code.
Other vulnerabilities in CIRCUTOR Q-SMT
Sources
Also known as GHSA-824r-f6r2-rhhx.