Vulnerability · Published Aug 19, 2024 · Assigned by VulDB

CVE-2024-7921Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control

Medium 4.3

In plain English

A medium-severity improper access control in Jieshun JieLink+ JSOTC2016 from Anhui Deshun Intelligent Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 45.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /report/ParkOutRecord/GetDataList. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
Anhui Deshun Intelligent Technology	Jieshun JieLink+ JSOTC2016	20240805

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

VDB-275071 | Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control vdb-entry
VDB-275071 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #387126 | 安徽德顺智能科技有限公司 JIELINK+ INTELLIGENT TERMINAL OPERATION PLATROFM JSOTC2016 fJeLink+ Improper Access Controls third-party-advisory
https://wiki.shikangsi.com/post/share/7d5eb025-1c30-44b4-b609-61938f6d6c05 exploit