CVE-2024-41692 json
Incorrect Access Control Vulnerability
published 2024-07-26 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-39137
- cvss
- 8.6
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system.
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary commands with root privileges on the targeted system.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- SyroTech SyroTech SY-GPON-1110-WDONT router
- syrotech sy-gpon-1110-wdont_firmware
Classification
- Weakness
-
- CWE-1191 On-Chip Debug and Test Interface With Improper Access Control
References
-
cert-in.org.in
/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
third-party-advisory
-
cert-in.org.in
/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225
third-party-advisory
Sources
- CVE List CVE-2024-41692
- NVD CVE-2024-41692
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.