CVE-2024-8888 Insufficient Session Expiration vulnerability on CIRCUTOR Q-SMT

Critical 10.0 Published 18 Sep 2024 Updated 18 Sep 2024

Attackers can steal non-expiring web tokens to bypass authentication and access the CIRCUTOR Q-SMT web application without restrictions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-8888?

CVE-2024-8888 is a critical vulnerability in CIRCUTOR Q-SMT, published on 18 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.

Weakness: CWE-613

Which versions are affected by CVE-2024-8888?

It affects 1 product.

Products include Circutor Q-Smt Firmware.

How do I fix CVE-2024-8888?

No fix has been published for CVE-2024-8888 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-8888 being exploited?

There is no known exploitation of CVE-2024-8888 in the wild and no public exploit code.

Sources

Also known as GHSA-9p5p-94m7-4mp9.