CVE-2024-41685

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to capture cookies and obtain sensitive information on the targeted system.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1004 CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Jul 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-416863.3This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could CVE-2024-416877.5This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text. A remote attacker could explo CVE-2024-416884.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the rout CVE-2024-416894.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmw CVE-2024-41698.8A vulnerability was found in Tenda 4G300 1.01.42. It has been declared as critical. This vulnerability affects the function sub_42775C/sub_4 CVE-2024-416904.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext wit CVE-2024-416914.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root file CVE-2024-416928.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper CVE-2024-416936.1Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-416945.3Cybonet - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-416957.5Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVE-2024-416967.5Priority PRI WEB Portal Add-On for Priority ERP on prem - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor