Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2024-36440

Description

An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device password via password-cracking methods, because unsalted MD5 is used.

POC

Reference

- http://seclists.org/fulldisclosure/2024/Aug/31

- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-037.txt

Github

No PoCs found on GitHub currently.