CVE-2024-7729

CAYIN Technology CMS - Sensitive File Download

State: Published
Severity: 7.5 High
Published: Aug 14, 2024
Updated: Aug 16, 2024
Reserved: Aug 13, 2024

Description

The CAYIN Technology CMS lacks proper access control, allowing unauthenticated remote attackers to download arbitrary CGI files.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	twcert

Weaknesses

CWE-552 Files or Directories Accessible to External Parties

Affected Products

Product	Versions
SMP-2100CAYIN Technology	3.0Affected
SMP-2200CAYIN Technology	3.0 through 4.0Affected
SMP-2210CAYIN Technology	3.0 through 4.0Affected
SMP-2300CAYIN Technology	3.0 through 4.0Affected
SMP-2310CAYIN Technology	3.0 through 4.0Affected
SMP-6000CAYIN Technology	3.0Affected
SMP-8000CAYIN Technology	3.0Affected
SMP-8000QDCAYIN Technology	3.0Affected
CMS-20CAYIN Technology	11.0Affected
CMS-60CAYIN Technology	11.0Affected
CMS-SECAYIN Technology	11.0Affected
CMS-SE(18.04)CAYIN Technology	11.0Affected
CMS-SE(22.04)CAYIN Technology	11.0Affected
SMP-8100CAYIN Technology	4.0Affected
SMP-2400CAYIN Technology	4.0Affected

References

https://www.twcert.org.tw/tw/cp-132-8003-5543e-1.htmlthird-party-advisory
https://www.twcert.org.tw/en/cp-139-8004-ed9aa-2.htmlthird-party-advisory
https://resource1.cayintech.com/patch/patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.