What is CVE-2024-39220?

CVE-2024-39220 is a medium-severity vulnerability in N/a, classified under Plaintext Storage of a Password. CVSS score: 6.5/10. Published 2024-07-03.

How severe is CVE-2024-39220?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2024-39220 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in N/a

CVE-2024-39220

BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request.

EPSS: 0.004 (36.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.

Affected products

N/a — versions n/a

Weakness classification (CWE)

CWE-256 — Plaintext Storage of a Password

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2024-39220?: CVE-2024-39220 is a medium-severity vulnerability in N/a, classified under Plaintext Storage of a Password. CVSS score: 6.5/10. Published 2024-07-03.
How severe is CVE-2024-39220?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2024-39220 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.