CVE-2024-54767
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2024-54767 is a high-severity Observable Discrepancy (CWE-203) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Discovery (T1087); ranked in the top 23% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-6 (Authentication Feedback) and SI-11 (Error Handling) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-54767 is an access control vulnerability affecting the /juis_boxinfo.xml endpoint on AVM FRITZ!Box 7530 AX devices running firmware version 7.59. The flaw permits unauthenticated retrieval of sensitive device information and carries a CVSS 3.1 base score of 7.5, reflecting network attack vector, low complexity, and high impact on confidentiality. The issue is tracked under CWE-203.
An unauthenticated remote attacker can send crafted requests to the affected endpoint and obtain sensitive information without any credentials. Exploitation requires no user interaction and can be performed over the network.
The vendor disputes the report, stating that the behavior cannot be reproduced under supported configurations and appears tied to an unintended direct internet exposure of the device. No official patches or mitigation guidance are referenced in the supplied sources.
The associated EPSS score has remained flat at 0.0919 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52668
Vulnerability Data
An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authentication. NOTE: this is disputed by the Supplier because it cannot be reproduced, and the issue report focuses on…
more
an unintended configuration with direct Internet exposure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Obscures authentication feedback so that success/failure differences are not observable to attackers.
Requires error messages to avoid revealing exploitable details, directly stopping observable response discrepancies.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent observable response discrepancies via consistent error handling and timing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Accurate, synchronized timestamps reduce observable timing discrepancies that an attacker could exploit to infer sensitive information or distinguish between success and failure paths.