CVEvulnerability

CVE-2024-12012

5.7 MEDIUM Published 2025-02-13 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-02-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-598

Description

A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. Both the SHA-1 hash of the password as well as the session tokens are included as part of the URL and therefore exposed to information leakage scenarios. An attacker capable of accessing such values (e.g., victim browser, network traffic inspection) can exploit this vulnerability to leak both the password hash as well as session tokens and bypass the authentication mechanism using a pass-the-hash attack.

Related

Weakness · CWE (1)

  • CWE-598 Use of HTTP Request With Sensitive Query String weakness

References