Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-9334 is a high-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Gov (inferred from references). Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-9334 is a high-severity vulnerability involving the use of hard-coded credentials (CWE-798) and storage of sensitive data in a mechanism without access control (CWE-921) in E-Kent Pallium Vehicle Tracking software. This flaw enables authentication bypass and affects all versions prior to 17.10.2024. Assigned a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), it highlights network-accessible exploitation with high confidentiality impact and low integrity impact.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows bypassing authentication controls, potentially granting access to sensitive data stored without proper access restrictions and enabling limited integrity modifications.
The primary advisory is available from the Turkish National Cyber Incident Response Center (USOM) at https://www.usom.gov.tr/bildirim/tr-25-0044, published on 2025-02-27. Mitigation involves updating to Pallium Vehicle Tracking version 17.10.2024 or later, as the issue is resolved in that release.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53949
Vulnerability Data
Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows Authentication Bypass. This issue affects Pallium Vehicle Tracking: before 17.10.2024.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of access authorizations on system resources including stored data, structurally eliminating storage without access control.
Authenticator management requires secure distribution and handling of credentials, structurally discouraging hard-coded values.
Cryptographic key management mandates proper establishment and handling instead of embedding keys in code.
SC-28 mandates protection of information at rest, which is achieved in part by applying access controls to the storage mechanism.
Least privilege restricts which users or processes can access stored sensitive data, reducing the set of entities that could reach unprotected storage.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining and enforcing access permissions on storage directly prevents the weakness.
Protecting data-at-rest typically requires access controls or encryption on storage mechanisms.
PR.AA-01's credential/key-management processes can reduce the incentive to embed secrets but do not address or detect hard-coded values in source code, so the weakness remains fully possible.
Logical access protections on environments can reduce exposure of uncontrolled storage.
PR.AA-02 addresses human identity proofing and per-person credential issuance at enrollment; it has no bearing on whether developers embed static credentials in software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access control policy directly requires protection of sensitive data wherever it is stored.
Granting and reviewing access rights prevents unauthorized access to sensitive data on storage media.
Information-access-restriction control directly enforces access controls on stored sensitive data.
Classification identifies sensitive data that must not be stored without access controls.
Education on secure configuration practices discourages technical staff from embedding or relying on hard-coded credentials in systems and applications.
Storage-media controls mandate physical and logical protection of media holding sensitive information.