{"id":"CVE-2024-29082","aliases":["EUVD-2024-34439","GHSA-fx2m-xj8m-g5xr"],"status":"published","title":"Vonets WiFi Bridges Improper Access Control","description":"Improper access control vulnerability affecting Vonets\n\n industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 \nand prior, enables an unauthenticated remote attacker to bypass \nauthentication and factory reset the device via unprotected goform \nendpoints.","severity":{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00797,"percentile":0.56772,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2024-08-08T19:23:23Z","modified":"2026-06-17T07:22:23Z","products":[{"vendor":"vonets","product":"vap11ac"},{"vendor":"vonets","product":"vap11ac_firmware"},{"vendor":"vonets","product":"vap11g"},{"vendor":"vonets","product":"vap11g-300"},{"vendor":"vonets","product":"vap11g-300_firmware"},{"vendor":"vonets","product":"vap11g-500"},{"vendor":"vonets","product":"vap11g-500_firmware"},{"vendor":"vonets","product":"vap11g-500s"},{"vendor":"vonets","product":"vap11g-500s_firmware"},{"vendor":"vonets","product":"vap11g_firmware"},{"vendor":"vonets","product":"vap11n-300"},{"vendor":"vonets","product":"vap11n-300_firmware"},{"vendor":"vonets","product":"vap11s"},{"vendor":"vonets","product":"vap11s-5g"},{"vendor":"vonets","product":"vap11s-5g_firmware"},{"vendor":"vonets","product":"vap11s_firmware"},{"vendor":"vonets","product":"var11n-300"},{"vendor":"vonets","product":"var11n-300_firmware"},{"vendor":"vonets","product":"var1200-h"},{"vendor":"vonets","product":"var1200-h_firmware"},{"vendor":"vonets","product":"var1200-l"},{"vendor":"vonets","product":"var1200-l_firmware"},{"vendor":"vonets","product":"var600-h"},{"vendor":"vonets","product":"var600-h_firmware"},{"vendor":"vonets","product":"vbg1200"},{"vendor":"vonets","product":"vbg1200_firmware"},{"vendor":"vonets","product":"vga-1000"},{"vendor":"vonets","product":"vga-1000_firmware"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29082"},{"url":"https://github.com/advisories/GHSA-fx2m-xj8m-g5xr"}],"sources":{"cve":[{"id":"CVE-2024-29082","title":"Vonets WiFi Bridges Improper Access Control","description":"Improper access control vulnerability affecting Vonets\n\n industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 \nand prior, enables an unauthenticated remote attacker to bypass \nauthentication and factory reset the device via unprotected goform \nendpoints.","status":"published","published":"2024-08-08T19:23:23.133Z","modified":"2024-08-21T20:03:57.401Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-34439","description":"Improper access control vulnerability affecting Vonets\n\n industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 \nand prior, enables an unauthenticated remote attacker to bypass \nauthentication and factory reset the device via unprotected goform \nendpoints.","status":"published","published":"2024-08-08T19:23:23Z","modified":"2024-08-21T20:03:57Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T00:56:13.735057Z"}],"ghsa":[{"id":"GHSA-fx2m-xj8m-g5xr","title":"Improper access control vulnerability affecting Vonets\n\n industrial wifi bridge relays and wifi...","description":"Improper access control vulnerability affecting Vonets\n\n industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 \nand prior, enables an unauthenticated remote attacker to bypass \nauthentication and factory reset the device via unprotected goform \nendpoints.","status":"published","published":"2024-08-12T15:30:49Z","modified":"2024-08-12T15:30:49Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:57:55.154597Z"}],"nvd":[{"id":"CVE-2024-29082","description":"Improper access control vulnerability affecting Vonets\n\n industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 \nand prior, enables an unauthenticated remote attacker to bypass \nauthentication and factory reset the device via unprotected goform \nendpoints.","status":"published","published":"2024-08-12T13:38:18.05Z","modified":"2026-06-17T07:22:23.257Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:10:18.563492Z"}]}}