CVE-2024-2420

LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements.

CVSS

No CVSS.

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01
https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf
https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01
https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf

Configurations

No configuration.

History

21 Nov 2024, 09:09

Type	Values Removed	Values Added
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01 -
References	~~() https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf -~~	() https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf -
Summary		(es) Se descubrió que el sistema de control de acceso y monitoreo de eventos LenelS2 NetBox contiene credenciales codificadas en versiones anteriores a la 5.6.1 incluida, lo que permite a un atacante eludir los requisitos de autenticación.

30 May 2024, 18:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-05-30 18:15

Updated : 2024-11-21 09:09

NVD link : CVE-2024-2420

Mitre link : CVE-2024-2420

CVE.ORG link : CVE-2024-2420

JSON object : View

Products Affected

No product.

CWE

CWE-259

Use of Hard-coded Password

{"id": "CVE-2024-2420", "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "productsecurity@carrier.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 8.8, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "LOW", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "LOW", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-05-30T18:15:09.070", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01", "source": "productsecurity@carrier.com"}, {"url": "https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf", "source": "productsecurity@carrier.com"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-01", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.corporate.carrier.com/Images/CARR-PSA-2024-01-NetBox_tcm558-227956.pdf", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "productsecurity@carrier.com", "description": [{"lang": "en", "value": "CWE-259"}]}], "descriptions": [{"lang": "en", "value": "LenelS2 NetBox access control and event monitoring system was discovered to contain\u00a0Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements."}, {"lang": "es", "value": "Se descubri\u00f3 que el sistema de control de acceso y monitoreo de eventos LenelS2 NetBox contiene credenciales codificadas en versiones anteriores a la 5.6.1 incluida, lo que permite a un atacante eludir los requisitos de autenticaci\u00f3n."}], "lastModified": "2024-11-21T09:09:42.940", "sourceIdentifier": "productsecurity@carrier.com"}