CVE-2024-0390 Vulnerability Details

  /     /     /  

CVE-2024-0390 Metadata Quick Info

CVE Published: 15/02/2024 | CVE Updated: 07/11/2024 | CVE Year: 2024
Source: CERT-PL | Vendor: INPRAX | Product: iZZi connect
Status : PUBLISHED

---

CVE-2024-0390 Description

INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access to manage and read parameters of the recuperation unit "reQnet iZZi".This issue affects "iZZi connect" application versions before 2024010401.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-798
CWE Name: CWE-798 Use of Hard-coded Credentials
Source: INPRAX

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-114
CAPEC Description: CAPEC-114 Authentication Abuse


Source: NVD (National Vulnerability Database).