CVE-2024-41688

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext credentials on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jul 26, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-416894.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmwCVE-2024-41698.8A vulnerability was found in Tenda 4G300 1.01.42. It has been declared as critical. This vulnerability affects the function sub_42775C/sub_4CVE-2024-416904.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext witCVE-2024-416914.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root fileCVE-2024-416928.6This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without properCVE-2024-416936.1Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-416945.3Cybonet - CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-416957.5Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted DirectoryCVE-2024-416967.5Priority PRI WEB Portal Add-On for Priority ERP on prem - CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-416976.1Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-416987.5Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-416997.5Priority – CWE-552: Files or Directories Accessible to External Parties
CVE-2024-41688: Medium severity, CVSS 4.6 | Vulnix