CVE-2024-27168CWE-798

Hardcoded keys used to generate authentication cookies

High · published June 14, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00286 · 20.1th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2024-06-14T03:53Z
EPSS history
Timeline
  • 14 JUN 03:53Z
    Hardcoded keys used to generate authentication cookies
    cvelistv5