CVE-2024-46040

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode leads the attacker to replay the Wi-Fi packets and forcefully turn off the access point after the authentication token has expired.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Oct 7, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-460418.8IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay.CVE-2024-460449.8CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function.CVE-2024-460459.8Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function.CVE-2024-460469.8Tenda FH451 v1.0.0.9 has a stack overflow vulnerability located in the RouteStatic function.CVE-2024-460477.5Tenda FH451 v1.0.0.9 has a stack overflow vulnerability in the fromDhcpListClient function.CVE-2024-460489.8Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i CVE-2024-460499.8Tenda O6 V3.0 firmware V1.0.0.7(2054) contains a stack overflow vulnerability in the formexeCommand function.CVE-2024-46058.8The Breakdance plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.7.1 via post meta data. T CVE-2024-460549.8OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to up CVE-2024-460554.8OpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in review names.CVE-2024-46065.4Deserialization of Untrusted Data vulnerability in BdThemes Ultimate Store Kit Elementor Addons.This issue affects Ultimate Store Kit Elemen CVE-2024-460607.8Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home direct