{"id":"CVE-2024-1039","state":"PUBLISHED","title":"Use of Hard-coded Credentials in Gessler GmbH WEB-MASTER","description":"Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web management of the device.","publishedAt":"2024-02-01T21:38:48.454Z","updatedAt":"2025-08-07T18:28:32.629Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"icscert"},"assigner":"icscert","products":["Gessler GmbH WEB-MASTER"],"affected":[{"vendor":"Gessler GmbH","product":"WEB-MASTER","defaultStatus":"unaffected","versions":[{"version":"7.9","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1039.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1039","state":"PUBLISHED","datePublished":"2024-02-01T21:38:48.454Z","dateUpdated":"2025-08-07T18:28:32.629Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2024-01-29T15:59:58.085Z"},"containers":{"cna":{"title":"Use of Hard-coded Credentials in Gessler GmbH WEB-MASTER","descriptions":[{"lang":"en","value":"Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web management of the device."}],"affected":[{"vendor":"Gessler GmbH","product":"WEB-MASTER","defaultStatus":"unaffected","versions":[{"version":"7.9","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"CWE-798 Use of Hard-coded Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-08-07T18:28:32.629Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Felix Eberstaller and Nino Fürthauer of Limes Security"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">Gessler GmbH recommends updating EZ2 to 3.2 or greater and WebMaster to 4.4 or greater to mitigate these vulnerabilities. Updates have to be applied by Gessler GmbH technicians. For more information contact </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.gessler.de/en/contact-us/\">Gessler GmbH</a><span style=\"background-color: rgb(255, 255, 255);\">.</span>\n\n<br>"}],"value":"Gessler GmbH recommends updating EZ2 to 3.2 or greater and WebMaster to 4.4 or greater to mitigate these vulnerabilities. Updates have to be applied by Gessler GmbH technicians. For more information contact  Gessler GmbH https://www.gessler.de/en/contact-us/ ."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01","tags":["government-resource","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:26:30.395Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-02-02T20:20:33.836369Z","id":"CVE-2024-1039","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-08T15:45:21.273Z"}}]}}}