CVE-2024-39220

Name: CVE-2024-39220
Creator: NVD / NIST
Published: 2024-07-03T15:15:05.993+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.5/10EPSS 0.44%

Last modified Jun 17, 2026

CVE-2024-39220 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request.. EPSS estimates a 0.44% chance of exploitation in the next 30 days.

Description

BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request.

Metrics

CVSS 3.1

6.5/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS Probability

0.44%

35.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-256

References

Timeline

Published: Jul 3, 2024
Last Modified: Jun 17, 2026
Status: Deferred

Frequently Asked Questions

What is CVE-2024-39220?

How severe is CVE-2024-39220?

CVE-2024-39220 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.44% probability of exploitation in the next 30 days.

How do I fix CVE-2024-39220?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-39220?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST