CVE-2024-1623: Insufficient session timeout vulnerability in Sagemcom router

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-14 · updated 2026-06-17
Weakness: CWE-613

Description

Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.

Affected products

Sagemcom F@St 3686 Firmware: before 3.709.2 — fixed in 3.709.2

How to fix

Upgrade to a fixed version: Sagemcom F@St 3686 Firmware 3.709.2. Check the vendor advisory for mitigations.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router
https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router

Get alerted when CVE-2024-1623 or the next vulnerability affects your stack