2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"DIRIS A-40","vendor":"Socomec","versions":[{"status":"affected","version":"1.8.1"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Socomec DIRIS A-40 power monitoring devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the web API implementation, which listens on TCP port 80 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-23993."},{"lang":"es","value":"Vulnerabilidad de omisión de autenticación de la API HTTP de Socomec DIRIS A-40. Esta vulnerabilidad permite a atacantes adyacentes a la red omitir la autenticación en instalaciones afectadas de dispositivos de monitoreo de energía Socomec DIRIS A-40. La autenticación no es necesaria para explotar esta vulnerabilidad.\n\nLa falla específica existe dentro de la implementación de la API web, que escucha en el puerto TCP 80 por defecto. El problema resulta de la falta de autenticación antes de permitir el acceso a la funcionalidad. Un atacante puede aprovechar esta vulnerabilidad para omitir la autenticación en el sistema. Fue ZDI-CAN-23993."}],"id":"CVE-2026-2491","lastModified":"2026-06-17T10:31:09.627","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.0"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-2491","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-16T15:26:54.111400Z","version":"2.0.3"}}]},"published":"2026-03-16T14:19:30.543","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://emea.socomec.com/en/resource-center/resource-type/cyber-vulnerabilities-601"},{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-129/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]}
|