Cyber Resilience

CVE-2024-54764

Medium

Published: 06 January 2025

Published
06 January 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.1106 93.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-54764 is a medium-severity an unspecified weakness vulnerability. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-25 (Reference Monitor).

Deeper analysis

An access control issue affects the /login/hostinfo2.cgi component in ipTIME A2004 firmware version 12.17.0. The vulnerability stems from missing authentication checks on this endpoint, enabling direct retrieval of sensitive device information.

Remote attackers can exploit the flaw over the network without credentials or user interaction. Successful access yields partial disclosure of sensitive data along with limited modification capabilities, reflected in the CVSS 3.1 score of 6.5.

Public references consist of technical disclosure write-ups hosted on GitHub that document the endpoint behavior but contain no vendor statements on patches or mitigation steps. The associated EPSS score remains flat at 0.1106 with no indicated rise after publication.

EU & UK References

Vulnerability details

An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication.

CWE(s)
None listed

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct unauthenticated bypass on public-facing CGI endpoint enables remote exploitation of the web application for info disclosure.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-14 Permitted Actions Without Identification or Authentication good match
prevent

Directly addresses permitted actions without authentication, preventing unauthenticated access to sensitive information in the /login/hostinfo2.cgi component.

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for logical access, blocking unauthorized retrieval of sensitive host information via the vulnerable endpoint.

AC-25 Reference Monitor good match
prevent

Implements a reference monitor for tamper-proof access control enforcement, mitigating bypasses that allow unauthenticated access to sensitive data.

References