Lucene search

K
cve[email protected]CVE-2024-5951
HistoryJun 13, 2024 - 8:15 p.m.

CVE-2024-5951

2024-06-1320:15:17
CWE-306
web.nvd.nist.gov
22
deep sea electronics dse855
authentication bypass
dos
vulnerability
web-based ui
zdi-can-23173

7.1 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

0.001 Low

EPSS

Percentile

28.9%

Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23173.

Affected configurations

Vulners
Node
deep_sea_electronicsdse855Range1.1.0

CNA Affected

[
  {
    "vendor": "Deep Sea Electronics",
    "product": "DSE855",
    "versions": [
      {
        "version": "1.1.0",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

7.1 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

0.001 Low

EPSS

Percentile

28.9%

Related for CVE-2024-5951