Find a vulnerability

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

2 vulnerabilities by bas-ip

CVE-2024-39220 (GCVE-0-2024-39220)

Vulnerability from nvd – Published: 2024-07-03 00:00 – Updated: 2024-08-02 04:19

Summary

BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-08 20:16 UTC

CWE

n/a
CWE-256 - Plaintext Storage of a Password

Assigner

mitre mitre root

References

2 references

URL	Tags
https://bas-ip.com/bsa-000001
https://github.com/DrieVlad/BAS-IP-vulnerabilities

Impacted products

29 products

Vendor	Product	Version
bas-ip	av-01d	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-01d::::::::
bas-ip	av-01md	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-01md::::::::
bas-ip	av-01mfd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-01mfd::::::::
bas-ip	av-01ed	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-01ed::::::::
bas-ip	av-01kd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-01kd::::::::
bas-ip	av-01bd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-01bd::::::::
bas-ip	av-02d	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-02d::::::::
bas-ip	av-02ide	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-02ide::::::::
bas-ip	av-02idr	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-02idr::::::::
bas-ip	av-02ipd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-02ipd::::::::
bas-ip	av-02fde	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-02fde::::::::
bas-ip	av-02fdr	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-02fdr::::::::
bas-ip	av-03d	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-03d::::::::
bas-ip	av-03bd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-03bd::::::::
bas-ip	av-04afd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-04afd::::::::
bas-ip	av-04asd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-04asd::::::::
bas-ip	av-04fd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-04fd::::::::
bas-ip	av-04sd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-04sd::::::::
bas-ip	av-05fd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-05fd::::::::
bas-ip	av-05sd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:av-05sd::::::::
bas-ip	aa-07bd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:aa-07bd::::::::
bas-ip	aa-07bdi	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:aa-07bdi::::::::
bas-ip	ba-04bd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:ba-04bd::::::::
bas-ip	ba-04md	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:ba-04md::::::::
bas-ip	ba-08bd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:ba-08bd::::::::
bas-ip	ba-08md	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:ba-08md::::::::
bas-ip	ba-12bd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:ba-12bd::::::::
bas-ip	ba-12md	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:ba-12md::::::::
bas-ip	cr-02bd	Affected: 0 , < 3.9.2 (custom) cpe:2.3:a:bas-ip:cr-02bd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-01d:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-01d",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-01md:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-01md",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-01mfd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-01mfd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-01ed:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-01ed",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-01kd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-01kd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-01bd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-01bd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-02d:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-02d",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-02ide:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-02ide",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-02idr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-02idr",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-02ipd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-02ipd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-02fde:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-02fde",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-02fdr:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-02fdr",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-03d:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-03d",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-03bd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-03bd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-04afd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-04afd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-04asd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-04asd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-04fd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-04fd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-04sd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-04sd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-05fd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-05fd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:av-05sd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "av-05sd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:aa-07bd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "aa-07bd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:aa-07bdi:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "aa-07bdi",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:ba-04bd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ba-04bd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:ba-04md:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ba-04md",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:ba-08bd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ba-08bd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:ba-08md:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ba-08md",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:ba-12bd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ba-12bd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:ba-12md:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ba-12md",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:bas-ip:cr-02bd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cr-02bd",
            "vendor": "bas-ip",
            "versions": [
              {
                "lessThan": "3.9.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-39220",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-08T20:16:48.281472Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-256",
                "description": "CWE-256 Plaintext Storage of a Password",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-09T13:17:06.088Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:19:20.684Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bas-ip.com/bsa-000001"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/DrieVlad/BAS-IP-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-03T15:06:58.900Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://bas-ip.com/bsa-000001"
        },
        {
          "url": "https://github.com/DrieVlad/BAS-IP-vulnerabilities"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-39220",
    "datePublished": "2024-07-03T00:00:00.000Z",
    "dateReserved": "2024-06-21T00:00:00.000Z",
    "dateUpdated": "2024-08-02T04:19:20.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}