Vulnerability · Published Aug 19, 2024 · Assigned by VulDB

CVE-2024-7920Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetParkInThroughDeivces access control

Medium 4.3

In plain English

A medium-severity improper access control in Jieshun JieLink+ JSOTC2016 from Anhui Deshun Intelligent Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 45.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, was found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. Affected is an unknown function of the file /Report/ParkCommon/GetParkInThroughDeivces. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
Anhui Deshun Intelligent Technology	Jieshun JieLink+ JSOTC2016	20240805

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

VDB-275070 | Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetParkInThroughDeivces access control vdb-entry
VDB-275070 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #387125 | 安徽德顺智能科技有限公司 JIELINK+ INTELLIGENT TERMINAL OPERATION PLATROFM JSOTC2016 fJeLink+ Improper Access Controls third-party-advisory
https://wiki.shikangsi.com/post/share/123687c4-ff4b-48e8-8299-6f4950a75af5 exploit