CVE-2024-36440

MEDIUM EPSS 20.9%

Published Aug 22, 20241y ago · Modified Jun 17, 20261w ago

6.8 CVSS 3.1

Medium

Published Aug 22, 2024 1y ago

Last Modified Jun 17, 2026 1w ago

Description

An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device password via password-cracking methods, because unsalted MD5 is used.

CVSS Details

Base Score

6.8

Exploitability

1.6

Impact

5.2

Vector string

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector Adjacent

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability None

Threat Intelligence

EPSS Exploit Probability

20.9% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 3

CWE-1393

CWE-327

CWE-759

References 3

seclists.org http://seclists.org/fulldisclosure/2024/Aug/31
swissphone.com https://www.swissphone.com/en-us/solutions/components/terminals/radio-data-module-dical-red/
syss.de https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-037.txt

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.