CVE-2024-21872

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critical operations to the transmitter.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-565

Affected software

No affected versions have been published.

Timeline

Published
Apr 18, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-218756.5Allocation of Resources Without Limits or Throttling vulnerability in Badge leading to a denial of service attack.Team Hacker Hotel Badge 20CVE-2024-218769.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formCVE-2024-218776.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (CVE-2024-218789.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as ECVE-2024-218798.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticatCVE-2024-21886.1Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability cCVE-2024-218807.2Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated CVE-2024-218818.6Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.TCVE-2024-218857.8A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certaCVE-2024-218867.8A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in CVE-2024-218879.1A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an autCVE-2024-218888.8A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a use
CVE-2024-21872: High severity, CVSS 7.5 | Vulnix