{"id":"CVE-2024-39815","state":"PUBLISHED","title":"Vonets WiFi Bridges Improper Check or Handling of Exceptional Conditions","description":"Improper check or handling of exceptional conditions vulnerability \naffecting Vonets\n\n \n\n industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an unauthenticated \nremote attacker to cause a denial of service. A specially-crafted \nHTTP request to pre-authentication resources can crash the service.","publishedAt":"2024-08-08T19:33:35.137Z","updatedAt":"2024-08-21T20:04:38.205Z","severity":{"score":9.4,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","source":"icscert"},"assigner":"icscert","products":["Vonets VAR1200-H","Vonets VAR1200-L","Vonets VAR600-H","Vonets VAP11AC","Vonets VAP11G-500S","Vonets VBG1200","Vonets VAP11S-5G","Vonets VAP11S","Vonets VAR11N-300","Vonets VAP11G-300","Vonets VAP11N-300","Vonets VAP11G","Vonets VAP11G-500","Vonets VGA-1000"],"affected":[{"vendor":"Vonets","product":"VAR1200-H","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAR1200-L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAR600-H","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11AC","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11G-500S","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VBG1200","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11S-5G","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11S","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAR11N-300","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11G-300","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11N-300","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11G","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11G-500","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VBG1200","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11AC","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VGA-1000","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08"],"weaknesses":["CWE-703"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/39xxx/CVE-2024-39815.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-39815","state":"PUBLISHED","datePublished":"2024-08-08T19:33:35.137Z","dateUpdated":"2024-08-21T20:04:38.205Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2024-07-30T16:15:10.109Z"},"containers":{"cna":{"title":"Vonets WiFi Bridges Improper Check or Handling of Exceptional Conditions","descriptions":[{"lang":"en","value":"Improper check or handling of exceptional conditions vulnerability \naffecting Vonets\n\n \n\n industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an unauthenticated \nremote attacker to cause a denial of service. A specially-crafted \nHTTP request to pre-authentication resources can crash the service."}],"affected":[{"vendor":"Vonets","product":"VAR1200-H","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAR1200-L","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAR600-H","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11AC","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11G-500S","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VBG1200","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11S-5G","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11S","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAR11N-300","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11G-300","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11N-300","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11G","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11G-500","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VBG1200","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VAP11AC","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]},{"vendor":"Vonets","product":"VGA-1000","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.4,"baseSeverity":"CRITICAL","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-703","description":"CWE-703","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2024-08-08T19:43:20.731Z"},"credits":[{"lang":"en","type":"finder","value":"Wodzen reported these vulnerabilities to CISA."}],"source":{"advisory":"ICSA-24-214-08","discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Vonets has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of the affected products are encouraged to \ncontact <a target=\"_blank\" rel=\"nofollow\" href=\"https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/support@vonets.com\">Vonets support</a> for additional information.\n\n<br>"}],"value":"Vonets has not responded to requests to work with CISA to mitigate these\n vulnerabilities. Users of the affected products are encouraged to \ncontact  Vonets support https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/support@vonets.com  for additional information."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"vonets","product":"var1200-h_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:var1200-h_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"var1200-l_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:var1200-l_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"var600-h_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:var600-h_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"vap11ac_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:vap11ac_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"vap11g-500s_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:vap11g-500s_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"vbg1200_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:vbg1200_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"vap11s-5g_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:vap11s-5g_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"vap11s_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:vap11s_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"var11n-300_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:var11n-300_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"vap11n-300_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"vap11g_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:vap11g_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"vga-1000_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:vga-1000_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"vap11g-300_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:vap11g-300_firmware:*:*:*:*:*:*:*:*"]},{"vendor":"vonets","product":"vap11n-300_firmware","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.23.6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:vonets:vap11n-300_firmware:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-09T14:41:59.876924Z","id":"CVE-2024-39815","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-21T20:04:38.205Z"}}]}}}