Vulnerability · Published Oct 11, 2023 · Assigned by talos
CVE-2023-24479
Critical 9.8
In plain English
A critical-severity improper access control in YF325 from Yifan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.8%top 21.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H