Lucene search

CERT-InCVE-2024-7408

HistoryAug 12, 2024 - 1:38 p.m.

CVE-2024-7408

2024-08-1213:38:41

CWE-319

CERT-In

web.nvd.nist.gov

airveda air quality monitor

information disclosure

vulnerability

transmission of sensitive information

ap pairing

wi-fi traffic

evil twin attack

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS4

8.6

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:N/SI:H/VA:H/SA:H

AI Score

Confidence

High

EPSS

0.001

Percentile

21.4%

JSON

This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode. An attacker in close proximity could exploit this vulnerability by capturing Wi-Fi traffic of Airveda-AP.

Successful exploitation of this vulnerability could allow the attacker to cause Evil Twin attack on the targeted system.

Affected configurations

Nvd

Node

airvedapm2.5_pm10_monitor_firmwareRange<7.4.4.39

AND

airvedapm2.5_pm10_monitorMatch-

VendorProductVersionCPE
airvedapm2.5_pm10_monitor_firmware*cpe:2.3:o:airveda:pm2.5_pm10_monitor_firmware:*:*:*:*:*:*:*:*
airvedapm2.5_pm10_monitor-cpe:2.3:h:airveda:pm2.5_pm10_monitor:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
airveda	pm2.5_pm10_monitor_firmware	*	cpe:2.3:o:airveda:pm2.5_pm10_monitor_firmware::::::::
airveda	pm2.5_pm10_monitor	-	cpe:2.3:h:airveda:pm2.5_pm10_monitor:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Air Quality Monitor PM2.5 PM10",
    "vendor": "Airveda",
    "versions": [
      {
        "lessThan": "7.4.4.39",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0233

CVSS3

6.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS4

8.6

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:N/SI:H/VA:H/SA:H

AI Score

Confidence

High

EPSS

0.001

Percentile

21.4%

JSON

Related for CVE-2024-7408