CVE-2024-8893 (GCVE-0-2024-8893)

Vulnerability from cvelistv5 – Published: 2025-02-14 16:33 – Updated: 2025-02-14 18:38
VLAI?
Summary
Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi‑Fi.This issue affects GW1500‑XS: 1.1.2.1.
Severity ?
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE
  • CWE-798 - Use of Hard-coded Credentials
Assigner
References
Impacted products
Vendor Product Version
GoodWe Technologies Co., Ltd. GW1500‑XS Affected: 1.1.2.1
Create a notification for this product.
Credits
OpenSource Security GmbH (https://os‑s.net)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8893",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-14T18:38:41.339865Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-14T18:38:48.818Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GW1500\u2011XS",
          "vendor": "GoodWe Technologies Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.2.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "OpenSource Security GmbH (https://os\u2011s.net)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500\u2011XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi\u2011Fi.\u003cp\u003eThis issue affects GW1500\u2011XS: 1.1.2.1.\u003c/p\u003e"
            }
          ],
          "value": "Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500\u2011XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi\u2011Fi.This issue affects GW1500\u2011XS: 1.1.2.1."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Access to the web interface of the inverter via Wi\u2011Fi"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798 Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-14T16:33:37.348Z",
        "orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "shortName": "ENISA"
      },
      "references": [
        {
          "url": "https://os-s.net/publications/advisories/CVE-2024-8893.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
    "assignerShortName": "ENISA",
    "cveId": "CVE-2024-8893",
    "datePublished": "2025-02-14T16:33:37.348Z",
    "dateReserved": "2024-09-16T13:09:21.400Z",
    "dateUpdated": "2025-02-14T18:38:48.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-8893\",\"sourceIdentifier\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\",\"published\":\"2025-02-14T17:15:18.690\",\"lastModified\":\"2025-02-14T17:15:18.690\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500\u2011XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi\u2011Fi.This issue affects GW1500\u2011XS: 1.1.2.1.\"},{\"lang\":\"es\",\"value\":\"La vulnerabilidad de uso de credenciales codificadas en GoodWe Technologies Co., Ltd. GW1500-XS permite que cualquier persona que se encuentre f\u00edsicamente cerca del dispositivo acceda completamente a la interfaz web del inversor a trav\u00e9s de Wi-Fi. Este problema afecta a GW1500-XS: 1.1.2.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":3.4}]},\"weaknesses\":[{\"source\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"references\":[{\"url\":\"https://os-s.net/publications/advisories/CVE-2024-8893.pdf\",\"source\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-8893\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-14T18:38:41.339865Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-14T18:38:44.906Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"OpenSource Security GmbH (https://os\\u2011s.net)\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Access to the web interface of the inverter via Wi\\u2011Fi\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"GoodWe Technologies Co., Ltd.\", \"product\": \"GW1500\\u2011XS\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.1.2.1\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://os-s.net/publications/advisories/CVE-2024-8893.pdf\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500\\u2011XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi\\u2011Fi.This issue affects GW1500\\u2011XS: 1.1.2.1.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500\\u2011XS allows anyone in physical proximity to the device to fully access the web interface of the inverter via Wi\\u2011Fi.\u003cp\u003eThis issue affects GW1500\\u2011XS: 1.1.2.1.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-798\", \"description\": \"CWE-798 Use of Hard-coded Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\", \"shortName\": \"ENISA\", \"dateUpdated\": \"2025-02-14T16:33:37.348Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-8893\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-14T18:38:48.818Z\", \"dateReserved\": \"2024-09-16T13:09:21.400Z\", \"assignerOrgId\": \"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\", \"datePublished\": \"2025-02-14T16:33:37.348Z\", \"assignerShortName\": \"ENISA\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.