Guangzhou Yingke Electronic Technology Ncast up to 2017 Guest Login /manage/IPSetup.php information disclosure

A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. Using CWE to declare the problem leads to CWE-200. The weakness was disclosed 01/07/2024. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-0305. The attack may be launched remotely. Technical details are available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The current price for an exploit might be approx. USD $0-$5k at the moment. The MITRE ATT&CK project declares the attack technique as T1592. It is declared as proof-of-concept. The exploit is available at github.com. As 0-day the estimated underground price was around $0-$5k. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

Field01/07/2024 09:09 PM01/25/2024 09:36 AM01/25/2024 09:40 AM
vendorGuangzhou Yingke Electronic TechnologyGuangzhou Yingke Electronic TechnologyGuangzhou Yingke Electronic Technology
nameNcastNcastNcast
version<=2017<=2017<=2017
componentGuest LoginGuest LoginGuest Login
file/manage/IPSetup.php/manage/IPSetup.php/manage/IPSetup.php
cwe200 (information disclosure)200 (information disclosure)200 (information disclosure)
risk111
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prNNN
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iNNN
cvss3_vuldb_aNNN
cvss3_vuldb_ePPP
cvss3_vuldb_rcRRR
urlhttps://github.com/2267787739/cve/blob/main/logic.mdhttps://github.com/2267787739/cve/blob/main/logic.mdhttps://github.com/2267787739/cve/blob/main/logic.md
availability111
publicity111
urlhttps://github.com/2267787739/cve/blob/main/logic.mdhttps://github.com/2267787739/cve/blob/main/logic.mdhttps://github.com/2267787739/cve/blob/main/logic.md
cveCVE-2024-0305CVE-2024-0305CVE-2024-0305
responsibleVulDBVulDBVulDB
date1704582000 (01/07/2024)1704582000 (01/07/2024)1704582000 (01/07/2024)
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_auNNN
cvss2_vuldb_ciPPP
cvss2_vuldb_iiNNN
cvss2_vuldb_aiNNN
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss2_vuldb_rlNDNDND
cvss3_vuldb_rlXXX
cvss2_vuldb_basescore5.05.05.0
cvss2_vuldb_tempscore4.34.34.3
cvss3_vuldb_basescore5.35.35.3
cvss3_vuldb_tempscore4.84.84.8
cvss3_meta_basescore5.35.36.0
cvss3_meta_tempscore4.84.85.9
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1704582000 (01/07/2024)1704582000 (01/07/2024)
cve_nvd_summaryA vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249872.A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249872.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iN
cvss3_nvd_aN
cvss2_nvd_avN
cvss2_nvd_acL
cvss2_nvd_auN
cvss2_nvd_ciP
cvss2_nvd_iiN
cvss2_nvd_aiN
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prN
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cL
cvss3_cna_iN
cvss3_cna_aN
cve_cnaVulDB
cvss2_nvd_basescore5.0
cvss3_nvd_basescore7.5
cvss3_cna_basescore5.3

Want to stay up to date on a daily basis?

Enable the mail alert feature now!