CVE-2024-6788
Published: 13 August 2024
Summary
CVE-2024-6788 is a high-severity Use of Default Credentials (CWE-1392) vulnerability in Phoenixcontact Charx Sec-3000 Firmware. Its CVSS base score is 8.6 (High).
Operationally, ranked in the top 11.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A remote unauthenticated attacker can exploit a weakness in the firmware update feature on the LAN interface of the affected device to reset the password of the predefined low-privileged account “user-app” back to its default value. The issue is tracked as CVE-2024-6788 with a CVSS 3.1 score of 8.6 and is associated with CWE-1392. No specific product names or software versions are identified in the available details beyond the device exposing this interface.
An attacker with network access to the LAN interface requires no authentication or user interaction to perform the password reset. Successful exploitation grants the attacker the ability to log in as the “user-app” account, resulting in limited confidentiality and integrity impacts combined with high availability impact on the device.
The primary reference is the VDE advisory VDE-2024-022, which security practitioners should consult for any vendor-specific mitigation steps or patches. The EPSS score reached a peak of 0.0546 after disclosure before receding to its current value of 0.0388, indicating limited but observable post-disclosure interest that has since declined.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-47818
Vulnerability details
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mandates replacement of default credentials during secure configuration and provisioning procedures.
Policy requires changing or avoiding default credentials during system setup and operation.
Unique identification requirement prevents use of default or shared credentials by organizational users.
Changing default authenticators prior to first use prevents use of default credentials.
Standards-compliant authentication mechanisms typically prohibit default credentials for cryptographic modules.
Consistent implementation of the strategy drives removal or mitigation of default credentials in procured systems and services.
Security functional requirements and acceptance criteria can stipulate that acquired systems must not use default credentials.
Documentation of known configuration vulnerabilities and secure setup practices reduces reliance on default credentials.