CVE-2024-0556
Xantech Wic1200 Firmware 1.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-0556 is a high-severity Weak Encoding for Password (CWE-261) vulnerability in Xantech Wic1200 Firmware. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Query Registry (T1012); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-16349
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability Data
A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1. This vulnerability allows a remote user to intercept the traffic and retrieve the credentials from another user and decode it in base64 allowing the attacker to…
more
see the credentials in plain text.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Cryptographic protection mandates approved algorithms and key management that preclude weak encoding schemes for sensitive data such as passwords.
Authenticator management requires secure generation, storage, and distribution of passwords rather than trivial encoding.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper cryptographic hashing for data-at-rest directly prevents trivial password encoding while the control addresses broader data protection needs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure handling and protection of authentication information, directly addressing weak password encoding.
Requires appropriate use of cryptography, indirectly discouraging weak encoding schemes.
Enforces secure coding practices that would reject trivial password encoding.