Riskcovery

CVE-2024-43812

Kieback&Peter DDC4000 Series Path Traversal Insufficiently Protected Credentials

State
Published
Severity
8.6 High
Published
Oct 22, 2024
Updated
Oct 23, 2024
Reserved
Aug 21, 2024

Read the record on cve.org

Description

Kieback & Peter's DDC4000 series has an insufficiently protected credentials vulnerability, which may allow an unauthenticated attacker with access to /etc/passwd to read the password hashes of all users on the system.

Scores

CVSSScoreVectorSource
4.08.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nicscert
3.18.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hicscert

Weaknesses

  • CWE-522 Insufficiently Protected Credentials

Affected Products

ProductVersions
DDC4040eKieback&Peter
  • 1.17.6 and earlierAffected
DDC4020eKieback&Peter
  • 1.17.6 and earlierAffected
DDC4400eKieback&Peter
  • 1.17.6 and earlierAffected
DDC4200eKieback&Peter
  • 1.17.6 and earlierAffected
DDC4002eKieback&Peter
  • 1.17.6 and earlierAffected
DDC4400Kieback&Peter
  • 1.12.14 and earlierAffected
DDC4200-LKieback&Peter
  • 1.12.14 and earlierAffected
DDC4200Kieback&Peter
  • 1.12.14 and earlierAffected
DDC4100Kieback&Peter
  • 1.7.4 and earlierAffected
DDC4002Kieback&Peter
  • 1.12.14 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.