CVE-2024-40087

Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.6 CRITICAL
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
mitreCNA
---
---
CISA-ADPADP
9.6 CRITICAL
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
VendorProductVersion
vilolivingvilo_5_firmware
𝑥
≤ 5.16.1.33
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://vilo.com
https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40087.md