ipTIME A2004 - Unauthorized Access

mediumseverity

5.3CVSS score

0.8%likelihood of exploitation, next 30 days

56%of all CVEs are less likely

Readycheck to confirm it

An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication.

Impact

Unauthenticated attackers can access sensitive device configuration information through the hostinfo.cgi endpoint without authentication.

Fix

Update ipTIME A2004 router to a version later than 12.17.0 that addresses the unauthorized access vulnerability.

How to confirm it

Send: GET {{BaseURL}}/login/hostinfo.cgi
Positive when: matches /^ipTIME/ AND contains in content_type "text/plain" AND status 200

Run it with nuclei: nuclei -id CVE-2024-54763 -u <target>

The full check

id: CVE-2024-54763

info:
  name: ipTIME A2004 - Unauthorized Access
  author: ritikchaddha
  severity: medium
  description: |
    An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication.
  impact: |
    Unauthenticated attackers can access sensitive device configuration information through the hostinfo.cgi endpoint without authentication.
  remediation: |
    Update ipTIME A2004 router to a version later than 12.17.0 that addresses the unauthorized access vulnerability.
  reference:
    - https://github.com/Shuanunio/CVE_Requests/blob/main/ipTIME/A2004/ipTIME_A2004_unauthorized_access_vulnerability_first.md
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54763
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-54763
    cwe-id: CWE-284
    epss-score: 0.00752
    epss-percentile: 0.55348
  metadata:
    verified: true
    max-request: 1
    vendor: ipTIME
    product: A2004
    shodan-query: http.title:"ipTIME"
    fofa-query: title="ipTIME"
  tags: cve,cve2024,iptime,router,unauth,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/login/hostinfo.cgi"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "^ipTIME"

      - type: word
        part: content_type
        words:
          - "text/plain"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from