CVEvulnerability

CVE-2024-8888

7.5 HIGH Published 2024-09-18 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2024-09-18
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-613

Description

An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.

Affected configurations

• circutor q-smt firmware 1.0.4

Weakness · not in database (1)

CWE-613

Referenced by CWE · observed example (1)

CWE-1463 Insufficient Session Timeout Value weakness

References