CVE-2024-38280: Cleartext Storage in a File or on Disk in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
Published Jun 13, 2024
·Updated
An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.
Affected Software
2 affected components
All of the following
Motorola Vigilant Fixed Lpr Coms Box Firmware<=3.1.171.9
Motorola Vigilant Fixed LPR Coms Box
Remediation
Information
Motorola Solutions recommends the following for each identified vulnerability:
CVE-2024-38280:
* Apply encryption to all Criminal Justice Information (CJI) data.
* Apply full disk encryption with LUKS encryption standards and add password protection
to the GRUB Bootloader.
* Perform column-level encryption for sensitive data in the database.
All devices shipped after May 10, 2024 are already using full disk encryption. All devices that
are not able to have full disk encryption applied have had all CJI data encrypted. No further
actions are required by customers.
Event History
Jun 13, 2024
CVE Published
via MITRE·05:05 PM
Data Sourced
via MITRE·05:05 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-38280?
CVE-2024-38280 has a high severity rating due to the exposure of sensitive data.
2
How can I mitigate CVE-2024-38280?
To mitigate CVE-2024-38280, ensure that sensitive data is encrypted before storage on thehard disk.
3
What systems are affected by CVE-2024-38280?
CVE-2024-38280 affects the Motorola Vigilant Fixed LPR Coms Box Firmware versions up to and including 3.1.171.9.
4
Can CVE-2024-38280 be exploited remotely?
CVE-2024-38280 requires physical access to the device, so it cannot be exploited remotely.
5
Is there a patch available for CVE-2024-38280?
There is currently no official patch for CVE-2024-38280, but users should implement data protection measures.