CVE-2024-37038

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Jun 12, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-370397.5CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially craCVE-2024-37049.8SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to CVE-2024-370408.1CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to CVE-2024-370417.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-370424.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabilityCVE-2024-370434.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allCVE-2024-370447.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-370454.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabilityCVE-2024-370464.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allCVE-2024-370476.5A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-370484.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabilityCVE-2024-370496.5A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,
CVE-2024-37038: High severity, CVSS 8.8 | Vulnix