CVE-2024-38284: Authentication Bypass by Capture-replay in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
Published Jun 13, 2024
·Updated
Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls.
Affected Software
1 affected component
Motorola Solutions Vigilant Fixed LPR Coms Box
Remediation
Information
Motorola Solutions recommends the following for each identified vulnerability:
CVE-2024-38284:
* Delete the log files.
* Install updated software not logging the credentialed web request.
Motorola Solutions has already remediated this vulnerability for all vulnerable systems. No further actions are required by customers.
Event History
Jun 13, 2024
CVE Published
via MITRE·05:22 PM
Data Sourced
via MITRE·05:22 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-38284?
CVE-2024-38284 is classified as a critical vulnerability due to its potential for allowing replay attacks.
2
How do I fix CVE-2024-38284?
To mitigate CVE-2024-38284, implement encryption for all transmitted data and regularly audit logs for unauthorized access.
3
What impact does CVE-2024-38284 have on my system?
CVE-2024-38284 allows an attacker to exploit logged data to replicate service calls, potentially compromising system integrity.
4
Which devices are affected by CVE-2024-38284?
CVE-2024-38284 affects the Motorola Solutions Vigilant Fixed LPR Coms Box.
5
Is there a workaround for CVE-2024-38284?
A potential workaround for CVE-2024-38284 is to limit access to the log files and enable strict access controls.