CVE-2024-41685 - CVE House
Back to Database
Status published Medium CVE-2024-41685

Cookie Without HTTPOnly Flag Set Vulnerability

Vulnerability Description

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to capture cookies and obtain sensitive information on the targeted system.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-41685

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • These vulnerabilities are discovered by Shravan Singh, Rahul Giri, & Karan Patel from Redfox Cyber Security Inc, Toronto, Canada.

References

More from SyroTech

View All →
CVE-2024-41692
Incorrect Access Control Vulnerability
High 8.6
CVE-2024-41691
Insecure Storage of Sensitive Information Vulnerability
High 7
CVE-2024-41690
Default Credential Storage in Plaintext Vulnerability
High 7
CVE-2024-41689
Hard-coded Credentials Vulnerability
Medium 5.2
CVE-2024-41688
Cleartext Storage of Sensitive Information Vulnerability
High 7

Affected Vendor

Affected Software

SyroTech SY-GPON-1110-WDONT router
Vulnerable Versions:
3.1.02-231102

Timeline

Official Publish: July 26th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-1004

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.