{"id":"CVE-2024-39220","state":"PUBLISHED","title":"BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04","description":"BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request.","publishedAt":"2024-07-03T00:00:00.000Z","updatedAt":"2024-08-02T04:19:20.684Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","source":"CISA-ADP"},"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://bas-ip.com/bsa-000001","https://github.com/DrieVlad/BAS-IP-vulnerabilities"],"weaknesses":["CWE-256"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/39xxx/CVE-2024-39220.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-39220","state":"PUBLISHED","datePublished":"2024-07-03T00:00:00.000Z","dateUpdated":"2024-08-02T04:19:20.684Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2024-06-21T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://bas-ip.com/bsa-000001"},{"url":"https://github.com/DrieVlad/BAS-IP-vulnerabilities"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"n/a"}]}],"providerMetadata":{"shortName":"mitre","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateUpdated":"2024-07-03T15:06:58.900Z"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"bas-ip","product":"av-01d","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-01d:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-01md","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-01md:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-01mfd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-01mfd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-01ed","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-01ed:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-01kd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-01kd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-01bd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-01bd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-02d","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-02d:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-02ide","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-02ide:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-02idr","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-02idr:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-02ipd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-02ipd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-02fde","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-02fde:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-02fdr","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-02fdr:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-03d","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-03d:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-03bd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-03bd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-04afd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-04afd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-04asd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-04asd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-04fd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-04fd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-04sd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-04sd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-05fd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-05fd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"av-05sd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:av-05sd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"aa-07bd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:aa-07bd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"aa-07bdi","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:aa-07bdi:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"ba-04bd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:ba-04bd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"ba-04md","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:ba-04md:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"ba-08bd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:ba-08bd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"ba-08md","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:ba-08md:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"ba-12bd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:ba-12bd:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"ba-12md","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:ba-12md:*:*:*:*:*:*:*:*"]},{"vendor":"bas-ip","product":"cr-02bd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"3.9.2","versionType":"custom"}],"cpes":["cpe:2.3:a:bas-ip:cr-02bd:*:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-07-08T20:16:48.281472Z","id":"CVE-2024-39220","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-256","type":"CWE","lang":"en","description":"CWE-256 Plaintext Storage of a Password"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-09T13:17:06.088Z"}},{"title":"CVE Program Container","references":[{"url":"https://bas-ip.com/bsa-000001","tags":["x_transferred"]},{"url":"https://github.com/DrieVlad/BAS-IP-vulnerabilities","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T04:19:20.684Z"}}]}}}