CVE-2024-54013
Last modified
CVE-2024-54013 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain conditions, lead to unintended access to protected functions. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain conditions, lead to unintended access to protected functions. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hanwhavision | Knb-2000 Firmware | < 2.23.01 |
| Hanwhavision | Knb-5000n Firmware | < 2.23.01 |
| Hanwhavision | Knd-2010 Firmware | < 2.23.01 |
| Hanwhavision | Knd-2020rn Firmware | < 2.23.01 |
| Hanwhavision | Knd-2080rn Firmware | < 2.23.01 |
| Hanwhavision | Xnv-L6080 Firmware | < 2.23.01 |
| Hanwhavision | Xnv-L6080a Firmware | < 2.23.01 |
| Hanwhavision | Xnv-L6080r Firmware | < 2.23.01 |
| Hanwhavision | Xnv-L6080ra Firmware | < 2.23.01 |
| Hanwhavision | Xnz-6320 Firmware | < 2.10.04 |
| Hanwhavision | Xnz-6320a Firmware | < 2.23.01 |
| Hanwhavision | Xnz-L6320 Firmware | < 2.10.04 |
| Hanwhavision | Xnz-L6320a Firmware | < 2.23.01 |
| Hanwhavision | Knd-5020rn Firmware | < 2.23.01 |
| Hanwhavision | Knd-5080rn Firmware | < 2.23.01 |
| Hanwhavision | Kno-2010rn Firmware | < 2.23.01 |
| Hanwhavision | Kno-2080rn Firmware | < 2.23.01 |
| Hanwhavision | Kno-2120rn Firmware | < 2.23.01 |
| Hanwhavision | Kno-5020rn Firmware | < 2.23.01 |
| Hanwhavision | Kno-5080rn Firmware | < 2.23.01 |
| Hanwhavision | Knp-2120hn Firmware | < 2.23.01 |
| Hanwhavision | Knp-2320rh Firmware | < 2.23.01 |
| Hanwhavision | Knp-2320rha Firmware | < 2.23.01 |
| Hanwhavision | Knp-2550rha Firmware | < 2.23.01 |
| Hanwhavision | Pnd-A6081rv Firmware | < 2.23.01 |
| Hanwhavision | Pnd-A9081rv Firmware | < 2.23.01 |
| Hanwhavision | Pnm-7000vd Firmware | < 2.23.00 |
| Hanwhavision | Pnm-7002vd Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9000vd Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9000vq Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9002vq Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9080vq Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9081vq Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9084qz Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9084qz1 Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9084rqz Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9084rqzt Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9085rqz Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9085rqzt Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9320vqp Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9321vqp Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9322vqp Firmware | < 2.23.00 |
| Hanwhavision | Pnv-A6081r Firmware | < 2.23.01 |
| Hanwhavision | Pnv-A9081r Firmware | < 2.23.01 |
| Hanwhavision | Qnd-C8013r Firmware | < 2.22.10 |
| Hanwhavision | Qnd-C8023r Firmware | < 2.22.10 |
| Hanwhavision | Qne-C8013rl Firmware | < 2.22.10 |
| Hanwhavision | Qne-C9013rl Firmware | < 2.22.10 |
| Hanwhavision | Qnf-8010 Firmware | < 2.10.03 |
| Hanwhavision | Qnf-C9010 Firmware | < 2.22.10 |
Showing 50 of 253 affected configurations. See NVD for the full list.
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-54013?
How severe is CVE-2024-54013?
How do I fix CVE-2024-54013?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-54008An authenticated Remote Code Execution (RCE) vulnerability e…7.2
- CVE-2024-54009Remote authentication bypass vulnerability in HPE Alletra St…4
- CVE-2024-5401Improper control of dynamically-managed code resources vulne…8.8
- CVE-2024-54010A vulnerability in the firewall component of HPE Aruba Netwo…3.4
- CVE-2024-54011Penetration Testing engineers at Amazon have discovered a fl…6.5
- CVE-2024-54012Penetration Testing engineers at Amazon discovered a vulnera…5.3
- CVE-2024-54014Improper authorization in handler for custom URL scheme issu…3.6
- CVE-2024-54015A vulnerability has been identified in SIPROTEC 5 6MD84 (CP3…8.7
- CVE-2024-54016Improper Handling of Highly Compressed Data (Data Amplificat…4.3
- CVE-2024-54017A vulnerability has been identified in SIPROTEC 5 6MD84 (CP3…6.9
- CVE-2024-54018Multiple improper neutralization of special elements used in…7.2
- CVE-2024-54019A improper validation of certificate with host mismatch in F…6.5
Are you affected by CVE-2024-54013?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST