CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-8891 – Exposure of Private Personal Information to an Unauthorized Actor vulnerability on CIRCUTOR Q-SMT
https://notcve.org/view.php?id=CVE-2024-8891
18 Sep 2024 — An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4. • https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-8888 – Insufficient Session Expiration vulnerability on CIRCUTOR Q-SMT
https://notcve.org/view.php?id=CVE-2024-8888
18 Sep 2024 — An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc. • https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products • CWE-613: Insufficient Session Expiration •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-8887 – Authentication bypass vulnerability on CIRCUTOR Q-SMT
https://notcve.org/view.php?id=CVE-2024-8887
18 Sep 2024 — CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow interacting with the device. • https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products • CWE-1284: Improper Validation of Specified Quantity in Input •