Insufficient Session Expiration vulnerability on CIRCUTOR Q-SMT
Vulnerability Description
An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8888
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Aarón Flecha
- Gabriel Vía Echezarreta
References
More from CIRCUTOR
View All →Affected Vendor
CIRCUTOR
View all reports →