CVE-2024-38280

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-313 CWE-312

Affected software

Vendor	Product	Versions
Motorola Solutions	Vigilant Fixed LPR Coms Box (BCAV1F2-C600)	<= 3.1.171.9
motorolasolutions	vigilant_fixed_lpr_coms_box	<= 3.1.171.9

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19Third Party Advisory, US Government Resource

Timeline

Published: Jun 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-382819.8An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.CVE-2024-382828.5Utilizing default credentials, an attacker is able to log into the camera's operating system which could allow changes to be made to the ope CVE-2024-382835.1Sensitive customer information is stored in the device without encryption.CVE-2024-382848.7Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replic CVE-2024-382857.0Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.CVE-2024-382867.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throu CVE-2024-382879.8The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers CVE-2024-382887.2A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated atta CVE-2024-382899.8A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated CVE-2024-38299.1qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit t CVE-2024-382905.3In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met.CVE-2024-382918.8In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation.