CVE-2024-54767

High

Published: 06 January 2025

Published

06 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0698 91.5th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-54767 is a high-severity Observable Discrepancy (CWE-203) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Directly defines and restricts permitted actions without authentication, preventing exposure of sensitive /juis_boxinfo.xml information to unauthenticated attackers.

AC-3 Access Enforcement good match

prevent

Enforces approved access authorizations on system components like /juis_boxinfo.xml, blocking unauthenticated access to sensitive information.

SC-7 Boundary Protection good match

prevent

Monitors and controls communications at external boundaries, mitigating direct Internet exposure of the vulnerable endpoint in unintended configurations.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1082 System Information Discovery Discovery

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

Unauthenticated remote info disclosure on public-facing router component directly enables exploitation of public-facing apps (T1190) for system info discovery (T1082) and local data retrieval (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authentication. NOTE: this is disputed by the Supplier because it cannot be reproduced, and the issue report focuses on…

an unintended configuration with direct Internet exposure.

Deeper analysisAI

CVE-2024-54767 is an access control vulnerability in the /juis_boxinfo.xml component of AVM FRITZ!Box 7530 AX version 7.59. Published on January 6, 2025, it enables attackers to obtain sensitive information without authentication and is associated with CWE-203 (Observable Discrepancy). The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no effects on integrity or availability.

Unauthenticated attackers with network access can exploit the vulnerability remotely with low attack complexity and no user interaction required. Exploitation allows retrieval of sensitive information exposed through the affected component.

The vulnerability is disputed by the supplier, AVM, who reports it cannot be reproduced, noting that the issue stems from an unintended configuration involving direct Internet exposure of the device. No patches or specific mitigations are detailed in available references, which include GitHub issue reports at https://github.com/Shuanunio/CVE_Requests/blob/main/AVM/fritz/AVM_FRITZ%21Box_7530%20AX_unauthorized_access_vulnerability_first.md and https://github.com/Shuanunio/CVE_Requests/issues/1.