CVE-2024-38279

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-288 CWE-306

Affected software

Vendor	Product	Versions
Motorola Solutions	Vigilant Fixed LPR Coms Box (BCAV1F2-C600)	<= 3.1.171.9
motorolasolutions	vigilant_fixed_lpr_coms_box_bcav1f2_c600	<= 3.1.171.9

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19Third Party Advisory, US Government Resource

Timeline

Published: Jun 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-38288.8The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the p CVE-2024-382804.6An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product CVE-2024-382819.8An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.CVE-2024-382828.5Utilizing default credentials, an attacker is able to log into the camera's operating system which could allow changes to be made to the ope CVE-2024-382835.1Sensitive customer information is stored in the device without encryption.CVE-2024-382848.7Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replic CVE-2024-382857.0Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.CVE-2024-382867.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throu CVE-2024-382879.8The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers CVE-2024-382887.2A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated atta CVE-2024-382899.8A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated CVE-2024-38299.1qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit t