CVE-2024-8887

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow interacting with the device.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-1284

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-88887.5An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web CVE-2024-88899.1Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device CVE-2024-88908.8An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credential CVE-2024-88915.3An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server CVE-2024-88929.1Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device CVE-2024-88937.3Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to CVE-2024-88948.1Out-of-bounds Write vulnerability was discovered in Open Design Alliance Drawings SDK before 2025.10. Reading crafted DWF file and missing p CVE-2024-88967.8A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A CVE-2024-88976.1Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be CVE-2024-88989.8A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry). This CVE-2024-88994.3The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via t CVE-2024-89007.5An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vuln