CVE-2024-38281

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

VendorProductVersions
Motorola SolutionsVigilant Fixed LPR Coms Box (BCAV1F2-C600)<= 3.1.171.9

References

Timeline

Published
Jun 13, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-382828.5Utilizing default credentials, an attacker is able to log into the camera's operating system which could allow changes to be made to the opeCVE-2024-382835.1Sensitive customer information is stored in the device without encryption.CVE-2024-382848.7Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicCVE-2024-382857.0Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.CVE-2024-382867.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throuCVE-2024-382879.8The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers CVE-2024-382887.2A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attaCVE-2024-382899.8A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated CVE-2024-38299.1qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit tCVE-2024-382905.3In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met.CVE-2024-382918.8In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation.CVE-2024-382929.8In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege
CVE-2024-38281: Critical severity, CVSS 9.8 | Vulnix