CVE-2024-41692
Incorrect Access Control Vulnerability
In short
A SyroTech router has an unprotected root terminal accessible via a physical serial port, allowing anyone with physical access to run commands as the administrator. This is a serious risk for anyone using this router at home or in a business.
Technical detail
CWE-1191 describes improper access control on initialization, maintenance, debug, or test interfaces. The SY-GPON-1110-WDONT exposes an unauthenticated root shell on its serial interface, enabling local privilege escalation via physical access without authentication. Successful exploitation grants arbitrary command execution with root privileges.
Summary generated and translated by AI from the official description.
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system.
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary commands with root privileges on the targeted system.
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
SyroTech · SyroTech SY-GPON-1110-WDONT routerWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →