Sensor Net Connect Firmware V2

sensor_net_connect_firmware_v2

Vendor: Proges • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-3083 1Proges 1Sensor Net Connect Firmware V2 Sep 30, 2024 Jul 31, 2024 N/A· v4 8.3 HIGH· v3 N/A· v2 A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a malicious web page.
CVE-2024-3082 1Proges 1Sensor Net Connect Firmware V2 Sep 30, 2024 Jul 31, 2024 N/A· v4 4.6 MEDIUM· v3 N/A· v2 A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext unless specific security measures at other la...Show more A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext unless specific security measures at other layers (e.g., full-disk encryption) have been enabled.Show less
CVE-2024-31200 1Proges 1Sensor Net Connect Firmware V2 Aug 12, 2024 Jul 31, 2024 N/A· v4 4.6 MEDIUM· v3 N/A· v2 A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext when an administrative sess...Show more A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext when an administrative session is open in the browser.Show less
CVE-2024-31199 1Proges 1Sensor Net Connect Firmware V2 Sep 30, 2024 Jul 31, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 A “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently inject arbitrary Javascript code.