CVE-2024-8888 — Insufficient Session Expiration vulnerability on CIRCUTOR Q-SMT

CVE-2024-8888

Insufficient Session Expiration vulnerability on CIRCUTOR Q-SMT PUBLISHED

Description (CNA)

An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc.

Affected (CNA)

Vendor / product	Versions
CIRCUTOR / CIRCUTOR Q-SMT	affected 1.0.4

CWE

CWE-613

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.