CVE-2024-45370

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-45370", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2024-11-27T15:59:57.067Z", "datePublished": "2025-12-01T15:25:42.865Z", "dateUpdated": "2025-12-01T20:23:08.223Z"}, "containers": {"cna": {"affected": [{"vendor": "Socomec", "product": "Easy Config System", "versions": [{"version": "2.6.1.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-302: Authentication Bypass by Assumed-Immutable Data", "type": "CWE", "cweId": "CWE-302"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2025-12-01T15:25:42.865Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2117", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2117"}, {"url": "https://www.socomec.fr/sites/default/files/2025-11/CVE-2024-45370---ECS-2610---CVSS31_VULNERABILITIES_2025-11-19-09-45-29_English_PLURI_3.pdf", "name": "https://www.socomec.fr/sites/default/files/2025-11/CVE-2024-45370---ECS-2610---CVSS31_VULNERABILITIES_2025-11-19-09-45-29_English_PLURI_3.pdf"}], "credits": [{"lang": "en", "value": "Discovered by Kelly Patterson of Cisco Talos."}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2117"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-12-01T17:05:35.539Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-01T20:22:50.772602Z", "id": "CVE-2024-45370", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-01T20:23:08.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2117"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-12-01T17:05:35.539Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45370", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-01T20:22:50.772602Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-01T20:23:03.874Z"}}], "cna": {"credits": [{"lang": "en", "value": "Discovered by Kelly Patterson of Cisco Talos."}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Socomec", "product": "Easy Config System", "versions": [{"status": "affected", "version": "2.6.1.0"}]}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2117", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2117"}, {"url": "https://www.socomec.fr/sites/default/files/2025-11/CVE-2024-45370---ECS-2610---CVSS31_VULNERABILITIES_2025-11-19-09-45-29_English_PLURI_3.pdf", "name": "https://www.socomec.fr/sites/default/files/2025-11/CVE-2024-45370---ECS-2610---CVSS31_VULNERABILITIES_2025-11-19-09-45-29_English_PLURI_3.pdf"}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-302", "description": "CWE-302: Authentication Bypass by Assumed-Immutable Data"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2025-12-01T15:25:42.865Z"}}}, "cveMetadata": {"cveId": "CVE-2024-45370", "state": "PUBLISHED", "dateUpdated": "2025-12-01T20:23:08.223Z", "dateReserved": "2024-11-27T15:59:57.067Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2025-12-01T15:25:42.865Z", "assignerShortName": "talos"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Easy Config System", "vendor": "Socomec", "versions": [{"status": "affected", "version": "2.6.1.0"}]}], "source": "talos-cna@cisco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n existe en la funcionalidad de gesti\u00f3n de perfiles de usuario de Socomec Easy Config System 2.6.1.0. Un registro de base de datos especialmente dise\u00f1ado puede conducir a acceso no autorizado. Un atacante puede modificar una base de datos local para activar esta vulnerabilidad."}], "id": "CVE-2024-45370", "lastModified": "2026-09-26T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 4.7, "source": "talos-cna@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-45370", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-01T20:22:50.772602Z", "version": "2.0.3"}}]}, "published": "2025-12-01T16:15:49.757", "references": [{"source": "talos-cna@cisco.com", "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2117"}, {"source": "talos-cna@cisco.com", "url": "https://www.socomec.fr/sites/default/files/2025-11/CVE-2024-45370---ECS-2610---CVSS31_VULNERABILITIES_2025-11-19-09-45-29_English_PLURI_3.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2117"}], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-302"}], "source": "talos-cna@cisco.com", "type": "Secondary"}]}

{}

{"created": "2025-12-01T21:27:20.571814+00:00", "updated": "2025-12-01T21:27:20.571848+00:00", "vendors": ["socomec", "socomec$PRODUCT$easy_config_system"]}