CVE-2024-4425 - Vulnerability Details - OpenCVE

The access control in CemiPark software stores integration (e.g. FTP or SIP) credentials in plain-text. An attacker who gained unauthorized access to the device can retrieve clear text passwords used by the system.This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
http://cemi.pl/
https://cert.pl/en/posts/2024/05/CVE-2024-4423/
https://cert.pl/posts/2024/05/CVE-2024-4423/

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published: 2024-05-09T09:37:34.121Z

Updated: 2024-08-01T20:40:47.109Z

Reserved: 2024-05-02T11:55:32.891Z

Link: CVE-2024-4425

Vulnrichment

Updated: 2024-08-01T20:40:47.109Z

NVD

Status : Awaiting Analysis

Published: 2024-05-14T15:43:42.633

Modified: 2024-11-21T09:42:48.317

Link: CVE-2024-4425

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4425", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2024-05-02T11:55:32.891Z", "datePublished": "2024-05-09T09:37:34.121Z", "dateUpdated": "2024-08-01T20:40:47.109Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "CemiPark", "vendor": "CEMI Tomasz Pawe\u0142ek", "versions": [{"status": "affected", "version": "4.5"}, {"status": "affected", "version": "4.7"}, {"status": "affected", "version": "5.03"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Dariusz Go\u0144da"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The access control in <span style=\"background-color: rgb(255, 255, 255);\">CemiPark software</span> stores integration (e.g. FTP or SIP) credentials in plain-text. An attacker who gained unauthorized access to the device <span style=\"background-color: rgb(255, 255, 255);\">can retrieve clear text passwords</span> used by the system.<p>This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.</p>"}], "value": "The access control in\u00a0CemiPark software stores integration (e.g. FTP or SIP) credentials in plain-text. An attacker who gained unauthorized access to the device can retrieve clear text passwords used by the system.This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.\n\n"}], "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21 Exploitation of Trusted Credentials"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-256", "description": "CWE-256 Plaintext Storage of a Password", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2024-05-09T09:37:34.121Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2024/05/CVE-2024-4423/"}, {"tags": ["third-party-advisory"], "url": "https://cert.pl/posts/2024/05/CVE-2024-4423/"}, {"tags": ["product"], "url": "http://cemi.pl/"}], "source": {"discovery": "UNKNOWN"}, "title": "Storing credentials in plaintext in CemiPark", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-4425", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-13T13:11:47.619305Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:cemi_tomasz_pawetek:cemipark:*:*:*:*:*:*:*:*"], "vendor": "cemi_tomasz_pawetek", "product": "cemipark", "versions": [{"status": "affected", "version": "5.03"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:cemi_tomasz_pawetek:cemipark:*:*:*:*:*:*:*:*"], "vendor": "cemi_tomasz_pawetek", "product": "cemipark", "versions": [{"status": "affected", "version": "4.7"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:cemi_tomasz_pawetek:cemipark:*:*:*:*:*:*:*:*"], "vendor": "cemi_tomasz_pawetek", "product": "cemipark", "versions": [{"status": "affected", "version": "4.5"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:53:17.556Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:40:47.109Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://cert.pl/en/posts/2024/05/CVE-2024-4423/"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://cert.pl/posts/2024/05/CVE-2024-4423/"}, {"tags": ["product", "x_transferred"], "url": "http://cemi.pl/"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://cert.pl/en/posts/2024/05/CVE-2024-4423/", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://cert.pl/posts/2024/05/CVE-2024-4423/", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "http://cemi.pl/", "tags": ["product", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:40:47.109Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-4425", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-13T13:11:47.619305Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:cemi_tomasz_pawetek:cemipark:*:*:*:*:*:*:*:*"], "vendor": "cemi_tomasz_pawetek", "product": "cemipark", "versions": [{"status": "affected", "version": "5.03"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:cemi_tomasz_pawetek:cemipark:*:*:*:*:*:*:*:*"], "vendor": "cemi_tomasz_pawetek", "product": "cemipark", "versions": [{"status": "affected", "version": "4.7"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:cemi_tomasz_pawetek:cemipark:*:*:*:*:*:*:*:*"], "vendor": "cemi_tomasz_pawetek", "product": "cemipark", "versions": [{"status": "affected", "version": "4.5"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-13T13:13:59.176Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Storing credentials in plaintext in CemiPark", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Dariusz Go\u0144da"}], "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21 Exploitation of Trusted Credentials"}]}], "affected": [{"vendor": "CEMI Tomasz Pawe\u0142ek", "product": "CemiPark", "versions": [{"status": "affected", "version": "4.5"}, {"status": "affected", "version": "4.7"}, {"status": "affected", "version": "5.03"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert.pl/en/posts/2024/05/CVE-2024-4423/", "tags": ["third-party-advisory"]}, {"url": "https://cert.pl/posts/2024/05/CVE-2024-4423/", "tags": ["third-party-advisory"]}, {"url": "http://cemi.pl/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The access control in\u00a0CemiPark software stores integration (e.g. FTP or SIP) credentials in plain-text. An attacker who gained unauthorized access to the device can retrieve clear text passwords used by the system.This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.\n\n", "supportingMedia": [{"type": "text/html", "value": "The access control in <span style=\"background-color: rgb(255, 255, 255);\">CemiPark software</span> stores integration (e.g. FTP or SIP) credentials in plain-text. An attacker who gained unauthorized access to the device <span style=\"background-color: rgb(255, 255, 255);\">can retrieve clear text passwords</span> used by the system.<p>This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-256", "description": "CWE-256 Plaintext Storage of a Password"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2024-05-09T09:37:34.121Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4425", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:40:47.109Z", "dateReserved": "2024-05-02T11:55:32.891Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2024-05-09T09:37:34.121Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.1"}