CVE-2024-10381CWE-288

Authentication Bypass Vulnerability in Matrix Door Controller

Critical · published October 25, 2024

CVSS v4.0
9.3
EPSS
1%
Percentile
58.3
In the wild
Unconfirmed
What it is

🚨 A single crafty HTTP request is all it takes for an attacker to gain total control of your Cosec Vega FAXQ! 🔥 Think of it like leaving the front door of your smart home unlocked — anyone could just stroll in, turn off the lights, and even mess with the thermostat without you ever knowing! If exploited, this vulnerability could lead to unauthorized access, allowing attackers to manipulate device settings, monitor activity, or even disable essential security features. The potential for chaos is absolutely devastating — your entire system could be at the mercy of someone with bad intentions!

Put simply

Think of it like leaving the front door of your smart home unlocked — anyone could just stroll in, turn off the lights, and even mess with the thermostat without you ever knowing! This vulnerability arises from improper session management in the web-based management interface, enabling remote attackers to exploit it by sending a specially crafted HTTP request to the vulnerable device.

What to do

If exploited, this vulnerability could lead to unauthorized access, allowing attackers to manipulate device settings, monitor activity, or even disable essential security features. The potential for chaos is absolutely devastating — your entire system could be at the mercy of someone with bad intentions! To safeguard your systems, update the firmware to the latest version as soon as possible. Additionally, monitor device logs for any suspicious activity and consider implementing stricter access controls to mitigate potential risks. Don't wait! You've got this! Follow these steps, and you'll have your security locked down in no time! 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.00866 · 58.3th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2024-10-25T12:36Z
EPSS history
Timeline
  • 25 OCT 12:36Z
    Authentication Bypass Vulnerability in Matrix Door Controller
    cvelistv5