Cyber Resilience

CVE-2024-40090

Medium

Published: 21 October 2024

Published
21 October 2024
Modified
07 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0017 38.7th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-40090 is a medium-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Viloliving Vilo 5 Firmware. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique System Information Discovery (T1082); ranked at the 38.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Information Disclosure. An information leak in the Boa webserver allows remote, unauthenticated attackers to leak memory addresses of uClibc and the stack via sending a GET request to the index…

more

page.

CWE(s)
CWE-319

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1082 System Information Discovery Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1592.002 Software Reconnaissance
Adversaries may gather information about the victim's host software that can be used during targeting.
attack.mitre.org →
Why these techniques?

Unauthenticated remote information disclosure via the Boa webserver leaks uClibc and stack memory addresses, enabling system information discovery (T1082), gathering victim host software information (T1592.002), and exploitation of a public-facing web application (T1190).

Affected Assets

viloliving
vilo 5 firmware
≤ 5.16.1.33

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AT-3 Role-based Training
addresses: CWE-319

Role-based training covers secure transmission methods, mitigating cleartext transmission of sensitive data.

CA-3 Information Exchange
addresses: CWE-319

By requiring documented security controls for information exchanges, the control reduces the risk of cleartext transmission of sensitive data.

CM-13 Data Action Mapping
addresses: CWE-319

Mapping transmission actions in data flows helps prevent cleartext transmission of sensitive information.

CM-6 Configuration Settings
addresses: CWE-319

Settings can enforce secure transmission protocols to prevent cleartext transmission of sensitive data.

MP-1 Policy and Procedures
addresses: CWE-319

Policy addresses secure transport and handling of media to avoid cleartext transmission of sensitive information.

PM-17 Protecting Controlled Unclassified Information on External Systems
addresses: CWE-319

Enforces safeguards against cleartext transmission of CUI when data leaves organizational boundaries to external systems.

SA-9 External System Services
addresses: CWE-319

Explicit controls and continuous oversight on external system services prevent cleartext transmission of sensitive information over provider-managed channels.

SC-12 Cryptographic Key Establishment and Management
addresses: CWE-319

Key-establishment procedures specify secure distribution channels that preclude cleartext transmission of key material.

References