CVE-2024-38281CWE-798

Use of Hard-coded Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)

High · published June 13, 2024

CVSS v4.0
8.6
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

⚡ Hard-coded credentials for a hidden network are just waiting to be discovered! An attacker can waltz right into the maintenance console and gain control of your device. 🔥 Think of it like a hidden door in a house that only some people know about. If the door is left unlocked, anyone who stumbles upon it can walk right in, rummage through your belongings, and even change the locks! With these credentials, an attacker could access sensitive configurations and potentially disrupt service or compromise the network entirely. The risks are high, as they could gain control over critical device settings and expose your entire infrastructure to further attacks.

Put simply

Think of it like a hidden door in a house that only some people know about. If the door is left unlocked, anyone who stumbles upon it can walk right in, rummage through your belongings, and even change the locks! This vulnerability arises from hard-coded credentials associated with a wireless network that are embedded in the device. An attacker can exploit this by connecting to the hidden network to access the maintenance console without any prior authentication.

What to do

With these credentials, an attacker could access sensitive configurations and potentially disrupt service or compromise the network entirely. The risks are high, as they could gain control over critical device settings and expose your entire infrastructure to further attacks. To mitigate this risk, change the hard-coded credentials immediately and ensure that no default accounts remain active. Regularly audit network access settings and consider disabling the hidden network if it isn't necessary for operations. You've got this! By taking these steps, you can secure your device and keep your network safe. 🛡️

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00388 · 31.7th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2024-06-13T17:10Z
EPSS history
Timeline
  • 13 JUN 17:10Z
    Use of Hard-coded Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
    cvelistv5