CVE-2024-28809

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers to access various appliance services via hardcoded credentials.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-312 CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
infinera	hit_7300	5.60.50

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2024-28809Third Party Advisory

Timeline

Published: Sep 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-28818.8Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows al CVE-2024-288106.6An issue was discovered in Infinera hiT 7300 5.60.50. Sensitive information inside diagnostic files (exported by the @CT application) allows CVE-2024-288113.3An issue was discovered in Infinera hiT 7300 5.60.50. A web application allows a remote privileged attacker to execute applications containe CVE-2024-288128.8An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service (on the local management network interface) with hardcoded creden CVE-2024-288138.4An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management application allow an attacker CVE-2024-288159.8A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4 through 8.6 could allow access to sensitive i CVE-2024-288167.1Student Information Chatbot a0196ab allows SQL injection via the username to the login function in index.php.CVE-2024-288187.5An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos CVE-2024-28829.3SDG Technologies PnPSCADA allows a remote attacker to attach various entities without requiring system authentication. This breach could pot CVE-2024-288206.3Buffer overflow in the extract_openvpn_cr function in openvpn-cr.c in openvpn-auth-ldap (aka the Three Rings Auth-LDAP plugin for OpenVPN) 2 CVE-2024-288236.1Amazon AWS aws-js-s3-explorer (aka AWS JavaScript S3 Explorer) 1.0.0 allows XSS via a crafted S3 bucket name to index.html.CVE-2024-288247.8Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24,