CVE-2024-40119
Published: 17 July 2024
Summary
CVE-2024-40119 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 8.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 running Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability, tracked as CVE-2024-40119 and assigned CWE-352, in its password change function. The flaw carries a CVSS 3.1 score of 8.8 with an attack vector of network, low complexity, no required privileges, and required user interaction.
Remote attackers can exploit the issue by tricking an authenticated administrator into visiting a malicious page or link, allowing an unauthorized password change that leads to account takeover without the user's consent. The EPSS score remains flat at 0.0701 with no material increase after disclosure.
Public references consist of GitHub repositories that document the vulnerability but provide no vendor advisories, patches, or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38418
Vulnerability details
Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the password change function, which allows remote attackers to change the admin password without the user's consent, leading to a potential account…
more
takeover.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.
Detects anomalous request patterns consistent with cross-site request forgery.