{"id":"CVE-2024-1623","aliases":["EUVD-2024-17363","GHSA-p594-wh4r-v877"],"status":"published","title":"Insufficient session timeout vulnerability in Sagemcom router","description":"Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00179,"percentile":0.07532,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-613"],"published":"2024-03-14T12:47:40Z","modified":"2026-06-17T07:04:38Z","products":[{"vendor":"sagemcom","product":"f\\@st_3686_firmware"},{"vendor":"sagemcom","product":"fast3686 v2 vodafone"},{"vendor":"sagemcom","product":"fast3686_v2_vodafone"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1623"},{"url":"https://github.com/advisories/GHSA-p594-wh4r-v877"}],"sources":{"cve":[{"id":"CVE-2024-1623","title":"Insufficient session timeout vulnerability in Sagemcom router","description":"Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.","status":"published","published":"2024-03-14T12:47:40.629Z","modified":"2024-08-28T18:19:52.425Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:34:18.259965Z"}],"euvd":[{"id":"EUVD-2024-17363","description":"Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.","status":"published","published":"2024-03-14T12:47:40Z","modified":"2024-08-28T18:19:52Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:56:08.84137Z"}],"ghsa":[{"id":"GHSA-p594-wh4r-v877","title":"Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This...","description":"Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.","status":"published","published":"2024-03-14T15:34:06Z","modified":"2024-03-14T15:34:12Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:55:39.945482Z"}],"nvd":[{"id":"CVE-2024-1623","description":"Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.","status":"published","published":"2024-03-14T13:15:53.397Z","modified":"2026-06-17T07:04:38.747Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:09:40.831473Z"}]}}