CVE-2024-8890

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions due to the fact that the device only implements the HTTP protocol. This fact prevents a secure communication channel from being established.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-201

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-88915.3An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server CVE-2024-88929.1Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device CVE-2024-88937.3Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to CVE-2024-88948.1Out-of-bounds Write vulnerability was discovered in Open Design Alliance Drawings SDK before 2025.10. Reading crafted DWF file and missing p CVE-2024-88967.8A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A CVE-2024-88976.1Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be CVE-2024-88989.8A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry). This CVE-2024-88994.3The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via t CVE-2024-89007.5An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vuln CVE-2024-89017.5The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provid CVE-2024-89024.3The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13 CVE-2024-89034.7Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis