CVE-2024-41936

HIGH

Vonets Industrial WiFi Bridge Firmware < 3.3.23.6.9 - Unauthenticated Path Traversal and Authentication Bypass

Title source: llm
STIX 2.1

Description

A directory traversal vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to read arbitrary files and bypass authentication.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08

Scores

CVSS v3 7.5
EPSS 0.0170
EPSS Percentile 74.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (14)
vonets/vap11ac_firmware < 3.3.23.6.9
vonets/vap11g-300_firmware < 3.3.23.6.9
vonets/vap11g-500_firmware < 3.3.23.6.9
vonets/vap11g-500s_firmware < 3.3.23.6.9
vonets/vap11g_firmware < 3.3.23.6.9
vonets/vap11n-300_firmware < 3.3.23.6.9
vonets/vap11s-5g_firmware < 3.3.23.6.9
vonets/vap11s_firmware < 3.3.23.6.9
vonets/var11n-300_firmware < 3.3.23.6.9
vonets/var1200-h_firmware < 3.3.23.6.9
... and 4 more
Published Aug 12, 2024
Tracked Since Feb 18, 2026