CVE-2024-38279: Authentication Bypass Using an Alternate Path or Channel in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)

Q: What is the severity of CVE-2024-38279?

CVE-2024-38279 is considered high severity due to its potential for unauthorized access and exploitation.

Q: How do I fix CVE-2024-38279?

To fix CVE-2024-38279, update the Motorola Vigilant Fixed LPR Coms Box Firmware to a version later than 3.1.171.9.

Q: What impact does CVE-2024-38279 have on affected systems?

CVE-2024-38279 allows attackers to modify the bootloader and gain unauthorized access to sensitive data, such as password hashes.

Q: Which products are affected by CVE-2024-38279?

CVE-2024-38279 affects the Motorola Vigilant Fixed LPR Coms Box Firmware versions up to 3.1.171.9.

Q: Is there a known exploit for CVE-2024-38279?

Yes, CVE-2024-38279 is vulnerable to exploitation that allows attackers to bypass authentication using custom bootloader arguments.

Published Jun 13, 2024

Updated

The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes.

Affected Software

2 affected components

All of the following

Motorola Vigilant Fixed Lpr Coms Box Firmware<=3.1.171.9

Motorola Vigilant Fixed LPR Coms Box

Remediation

Information

Motorola Solutions recommends the following for each identified vulnerability: CVE-2024-38279: * Use secure boot implementation with an edit-resistant GRUB partition. * Additional mitigation consists in limiting the physical access to the device by following the best practices for device mounting. Edit-resistant grub partition has been remediated for all vulnerable systems. Motorola Solutions will release a secure boot implementation in Fall 2024. All customers will receive the update through OTA (over the air) mechanisms. No further actions are required by customers.

Event History

Jun 13, 2024

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-38279?

CVE-2024-38279 is considered high severity due to its potential for unauthorized access and exploitation.

How do I fix CVE-2024-38279?

To fix CVE-2024-38279, update the Motorola Vigilant Fixed LPR Coms Box Firmware to a version later than 3.1.171.9.

What impact does CVE-2024-38279 have on affected systems?