VulnerabilityDeferred

CVE-2024-45494

The authentication for this user is implemented through an unsafe shared secret that is static in all affected firmware versions.

CRITICAL 9.8EPSS 0.47%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has an internally used shared administrative user account on all devices. The authentication for this user is implemented through an unsafe shared secret that is static in all affected firmware versions.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.47% probability · 40th percentile
CISA KEV: Not listed
Weakness: CWE-276
Source: cve@mitre.org

References

https://us.msasafety.com/fieldserver
https://us.msasafety.com/security-notices

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.