CVE-2024-46887CWE-288

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint

Medium · published October 8, 2024

CVSS v4.0
6.9
EPSS
1%
Percentile
45.7
In the wild
Unconfirmed
What it is

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum communication load.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00557 · 45.7th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2024-10-08T08:40Z
EPSS history
Timeline
  • 08 OCT 08:40Z
    The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint
    cvelistv5