CVE-2024-38283

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

Sensitive customer information is stored in the device without encryption.

Metrics

CVSS 4.0 5.1/10CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-311

Affected software

No affected versions have been published.

Timeline

Published
Jun 13, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-382848.7Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicCVE-2024-382857.0Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.CVE-2024-382867.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throuCVE-2024-382879.8The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers CVE-2024-382887.2A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attaCVE-2024-382899.8A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated CVE-2024-38299.1qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit tCVE-2024-382905.3In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met.CVE-2024-382918.8In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation.CVE-2024-382929.8In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege CVE-2024-382939.6ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php.CVE-2024-382949.8ALCASAR before 3.6.1 allows email_registration_back.php remote code execution.
CVE-2024-38283: Medium severity, CVSS 5.1 | Vulnix