CVSS 4.0
8.7 highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2024-58337
High (8.7) in akuvox. EPSS 0.2% chance of exploitation in the next 30 days.
Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations. Attackers can exploit this vulnerability to escalate privileges and gain unauthorized access to administrative functionalities.
Severity
CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- akuvox:c313w-2_firmware
- akuvox:e16c_firmware
- akuvox:nc-2_firmware
- akuvox:ns-2_firmware
- akuvox:nx-2_firmware
- akuvox:r20a-2_firmware
- akuvox:r20k-2_firmware
- akuvox:r29_firmware
- akuvox:s532_firmware
- akuvox:s539_firmware
- akuvox:x912_firmware
- akuvox:x915_firmware
- akuvox:x916_firmware
References
- https://cxsecurity.com/issue/WLB-2024110042
- https://packetstormsecurity.com/files/182870/
- https://www.vulncheck.com/advisories/akuvox-smart-intercom-s-improper-access-control-via-serviceshttpapi
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5862.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5862.php