Unitronics Vision 530 password recoverable

Summaryinfo

A vulnerability marked as critical has been reported in Unitronics Vision 120, Vision 230, Vision 280, Vision 290 and Vision 530. The affected element is an unknown function. Performing a manipulation results in password recoverable. This vulnerability is identified as CVE-2024-1480. The attack can be initiated remotely. There is not any exploit available. It is suggested to use restrictive firewalling.

Detailsinfo

A vulnerability classified as critical has been found in Unitronics Vision 120, Vision 230, Vision 280, Vision 290 and Vision 530. This affects an unknown code. The manipulation with an unknown input leads to a password recoverable vulnerability. CWE is classifying the issue as CWE-257. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. This is going to have an impact on confidentiality.

It is possible to read the advisory at cisa.gov. This vulnerability is uniquely identified as CVE-2024-1480. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

It is possible to mitigate the weakness by firewalling .

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Unitronics

Name

• Vision 120
• Vision 230
• Vision 280
• Vision 290
• Vision 530

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion