CVE-2024-38270

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-331

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-382714.8There exists a vulnerability in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created fo CVE-2024-382724.3There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in CVE-2024-382735.4Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to acc CVE-2024-382746.1Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.CVE-2024-382757.5The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be CVE-2024-382768.8Incorrect CSRF token checks resulted in multiple CSRF risks.CVE-2024-382775.4A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between CVE-2024-382786.6A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUG CVE-2024-382794.6The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain acces CVE-2024-38288.8The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the p CVE-2024-382804.6An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product CVE-2024-382819.8An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.