CVE-2024-45841

MEDIUM EXPLOITED

I-O DATA DEVICE UD-LT1 and UD-LT1/EX <= 2.1.9 - Unauthenticated Information Disclosure via Guest Account File Access

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-45841 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

Incorrect permission assignment for critical resource issue exists in UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier. If an attacker with the guest account of the affected products accesses a specific file, the information containing credentials may be obtained.

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0047
EPSS Percentile 37.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2024-12-04
CWE
CWE-732
Status published
Products (2)
I-O DATA DEVICE, INC./UD-LT1 firmware Ver.2.1.9 and earlier
I-O DATA DEVICE, INC./UD-LT1/EX firmware Ver.2.1.9 and earlier
Published Dec 05, 2024
Tracked Since Feb 18, 2026