CVE-2024-1039
Published: 01 February 2024
Summary
CVE-2024-1039 is a critical-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Gesslergmbh Web-Master Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 36.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-16815
Vulnerability details
Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web management of the device.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Detects unauthorized successful logons resulting from improper authentication implementations.
Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.
Documented IA policy and procedures require proper authentication mechanisms to be defined and followed, reducing improper authentication.
Identity providers centralize and enforce authentication mechanisms, reducing improper authentication.
Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code.
Hunting detects anomalous authentication patterns or successful bypasses that allow persistent unauthorized entry.
Requiring explicit security roles and risk integration in the SDLC forces authentication mechanisms to be planned, documented, and validated instead of omitted or weakly implemented.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.