CVE-2024-39601CWE-306

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0)

High · published July 22, 2024

CVSS v4.0
7.1
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). Affected devices allow a remote authenticated user or an unauthenticated user with physical access to downgrade the firmware of the device. This could allow an attacker to downgrade the device to older versions with known vulnerabilities.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00524 · 43.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2024-07-22T13:54Z
EPSS history
Timeline
  • 22 JUL 13:54Z
    A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0)
    cvelistv5