VulnerabilityModified
CVE-2024-58337
Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations.
HIGH 8.7EPSS 0.24%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations. Attackers can exploit this vulnerability to escalate privileges and gain unauthorized access to administrative functionalities.
- CVSS 4.0
- 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.24% probability · 15th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- akuvox/s539 firmware · akuvox/s532 firmware · akuvox/x916 firmware · akuvox/x915 firmware · akuvox/x912 firmware · akuvox/r29 firmware · akuvox/e16c firmware · akuvox/r20k-2 firmware · akuvox/r20a-2 firmware · akuvox/c313w-2 firmware · akuvox/ns-2 firmware · akuvox/nc-2 firmware · akuvox/nx-2 firmware
- Source
- disclosure@vulncheck.com
References
- https://cxsecurity.com/issue/WLB-2024110042Third Party Advisory
- https://packetstormsecurity.com/files/182870/Broken Link
- https://www.vulncheck.com/advisories/akuvox-smart-intercom-s-improper-access-control-via-serviceshttpapiThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5862.phpThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5862.phpThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.