CVE-2024-8891 Exposure of Private Personal Information to an Unauthorized Actor vulnerability on CIRCUTOR Q-SMT
An attacker can enumerate valid users in CIRCUTOR Q-SMT by analyzing server responses, leading to unauthorized disclosure of private personal information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8891?
CVE-2024-8891 is a medium-severity vulnerability in CIRCUTOR Q-SMT, published on 18 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4.
Weakness: CWE-359
Which versions are affected by CVE-2024-8891?
It affects 1 product.
Products include Circutor Q-Smt Firmware.
How do I fix CVE-2024-8891?
No fix has been published for CVE-2024-8891 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-8891 being exploited?
There is no known exploitation of CVE-2024-8891 in the wild and no public exploit code.
Other vulnerabilities in CIRCUTOR Q-SMT
Sources
Also known as GHSA-g399-5j3g-vm56.