CVE-2024-8889CWE-20

Improper Input Validation vulnerability on CIRCUTOR TCP2RS+

Critical · published September 18, 2024

CVSS v3.1
9.3
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

🚨 A sneaky packet through UDP port 2000 is all it takes to turn your CIRCUTOR TCP2RS+ device into an unresponsive brick! 🔥 Think of it like a contractor showing up at your office, claiming they have the authority to change the building's layout—it's a recipe for chaos! An attacker could completely change any configuration setting, even with user/password protection in place, rendering the device useless. This could lead to significant disruptions in operations, especially since the equipment is already at the end of its life cycle, making a swift response absolutely critical!

Put simply

Think of it like a contractor showing up at your office, claiming they have the authority to change the building's layout—it's a recipe for chaos! This vulnerability allows unauthorized modification of configuration values on CIRCUTOR TCP2RS+ firmware version 1.3b via UDP packets, even with authentication features enabled, effectively bypassing any security measures in place.

What to do

An attacker could completely change any configuration setting, even with user/password protection in place, rendering the device useless. This could lead to significant disruptions in operations, especially since the equipment is already at the end of its life cycle, making a swift response absolutely critical! It's crucial to patch the firmware immediately if an update or fix becomes available. Additionally, consider disabling or blocking UDP port 2000 to safeguard against unauthorized access until a solution is implemented. 🛡️ You've got this! Act fast, and you'll keep your systems secure and running smoothly! 💪✨

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-09-18T12:00Z
EPSS history
Timeline
  • 18 SEP 12:00Z
    Improper Input Validation vulnerability on CIRCUTOR TCP2RS+
    cvelistv5