CVE-2024-58300CWE-306

CVE-2024-58300

published December 12, 2025

CVSS
8.7
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

Siklu MultiHaul TG series devices before version 2.0.0 contain an unauthenticated vulnerability that allows remote attackers to retrieve randomly generated credentials via a network request. Attackers can send a specific hex-encoded command to port 12777 to obtain username and password, enabling direct SSH access to the device.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-12-12T03:15Z
References (3)
https://siklu.com/ · [email protected]https://www.exploit-db.com/exploits/51932 · [email protected]https://www.vulncheck.com/advisories/siklu-multihaul-tg-series-unauthenticated-credential-disclosure-vulnerability · [email protected]
EPSS history
Timeline
  • 11 DEC 21:39Z
    Siklu MultiHaul TG Series < 2.0.0 Unauthenticated Credential Disclosure Vulnerability
    cvelistv5