CVE-2024-5632

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network with a default password. A user is neither advised to change it during the installation process, nor such a need is described in the manual. As the cameras from the same kit connect automatically, it is very probable for the default password to be left unchanged.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-1392

Affected software

No affected versions have been published.

Timeline

Published: Jul 9, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-563208.8GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorizatio CVE-2024-563213.8GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration CVE-2024-563227.2GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse a hidden/unused configur CVE-2024-563239.8OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.CVE-2024-563247.1GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML config CVE-2024-563259.8Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Respo CVE-2024-563267.8Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format al CVE-2024-563279.8pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying CVE-2024-563286.1Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a CVE-2024-563298.9Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by La CVE-2024-56337.5Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the sa CVE-2024-563309.3Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. Th