This vulnerability allows an attacker to gain unauthorized access to a configuration web page delivered by the integrated web server of EIBPORT. It affects EIBPORT V3 KNX and EIBPORT V3 KNX GSM up to version 3.9.8.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.4 | CVE-2024-13967 |
Exploitation
To exploit this vulnerability, an attacker can send crafted requests to the EIBPORT web server, which may allow them to access sensitive configuration settings without proper authentication. This requires the attacker to be on the same network as the device and to interact with the web interface.
Affected Products
- EIBPORT V3 KNX: A smart home automation device that allows for integration and control of various systems.
- EIBPORT V3 KNX GSM: A variant of the EIBPORT that includes GSM capabilities for remote access and control.
Mitigation
To mitigate this vulnerability, it is recommended to update the EIBPORT devices to the latest firmware version that addresses this issue. Additionally, network segmentation and proper firewall rules should be implemented to restrict access to the web server.