CVE-2024-28747

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

VendorProductVersions
ifmSmart PLC AC14xx Firmware<= V4.3.17
ifmSmart PLC AC4xxS Firmware<= V4.3.17
ifmsmart_plc_ac14xx_firmware<= 4.3.17
ifmsmart_plc_ac4xxs_firmware<= 4.3.17

References

Timeline

Published
Jul 9, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-287487.2A remote attacker with high privileges may use a reading file function to inject OS commands.CVE-2024-287497.2A remote attacker with high privileges may use a writing file function to inject OS commands.CVE-2024-287507.2A remote attacker with high privileges may use a deleting file function to inject OS commands.CVE-2024-287519.1An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.CVE-2024-287529.3A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF CVE-2024-287536.5RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.CVE-2024-287547.5RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.CVE-2024-287556.5An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum CVE-2024-287565.9The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (MiCVE-2024-287577.5libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityPCVE-2024-287594.3A crafted network packet may cause a buffer overrun in Wind River VxWorks 7 through 23.09.CVE-2024-28769.8The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln
CVE-2024-28747: Critical severity, CVSS 9.8 | Vulnix