{"id":"CVE-2024-45832","state":"PUBLISHED","title":"Ossur Mobile Logic Application Use of Hard-coded Credentials","description":"Hard-coded credentials were included as part of the application binary. \nThese credentials served as part of the application authentication flow \nand communication with the mobile application. An attacker could access \nunauthorized information.","publishedAt":"2025-01-17T16:49:56.088Z","updatedAt":"2025-01-17T17:59:26.276Z","severity":{"score":2,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:H/SA:N","source":"icscert"},"assigner":"icscert","products":["Ossur Mobile Logic Application"],"affected":[{"vendor":"Ossur","product":"Mobile Logic Application","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.5.5","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/45xxx/CVE-2024-45832.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-45832","state":"PUBLISHED","datePublished":"2025-01-17T16:49:56.088Z","dateUpdated":"2025-01-17T17:59:26.276Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2024-12-17T14:11:48.984Z"},"containers":{"cna":{"title":"Ossur Mobile Logic Application Use of Hard-coded Credentials","descriptions":[{"lang":"en","value":"Hard-coded credentials were included as part of the application binary. \nThese credentials served as part of the application authentication flow \nand communication with the mobile application. An attacker could access \nunauthorized information."}],"affected":[{"vendor":"Ossur","product":"Mobile Logic Application","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.5.5","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"PHYSICAL","baseScore":2,"baseSeverity":"LOW","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:H/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"CWE-798 Use of Hard-coded Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-01-17T16:49:56.088Z"},"credits":[{"lang":"en","type":"finder","value":"Bryan Riggins reported these vulnerabilities to CISA."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Ossur recommends users download Version 1.5.5 or later of the mobile \napplication. The latest version of the application can be obtained \nthrough the app store on respective mobile devices. No additional action\n is required by users.\n\n<br>"}],"value":"Ossur recommends users download Version 1.5.5 or later of the mobile \napplication. The latest version of the application can be obtained \nthrough the app store on respective mobile devices. No additional action\n is required by users."}],"source":{"advisory":"ICSMA-24-354-01","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-17T17:49:56.727185Z","id":"CVE-2024-45832","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-17T17:59:26.276Z"}}]}}}