What’s Vulnerable › Vulnerabilities

CVE-2024-39220

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-03 · updated 2026-06-17
• Weakness: CWE-256

Description

BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request.

Affected products

• Bas-Ip Aa-07Bd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Aa-07Bdi: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-01Bd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-01D: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-01Ed: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-01Kd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-01Md: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-01Mfd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-02D: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-02Fde: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-02Fdr: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-02Ide: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-02Idr: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-02Ipd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-03Bd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-03D: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-04Afd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-04Asd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-04Fd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-04Sd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-05Fd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Av-05Sd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Ba-04Bd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Ba-04Md: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Ba-08Bd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Ba-08Md: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Ba-12Bd: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Ba-12Md: before 3.9.2 — fixed in 3.9.2
• Bas-Ip Cr-02Bd: before 3.9.2 — fixed in 3.9.2

How to fix

Upgrade to a fixed version: Bas-Ip Aa-07Bd 3.9.2; Bas-Ip Aa-07Bdi 3.9.2; Bas-Ip Av-01Bd 3.9.2; Bas-Ip Av-01D 3.9.2; Bas-Ip Av-01Ed 3.9.2; Bas-Ip Av-01Kd 3.9.2; Bas-Ip Av-01Md 3.9.2; Bas-Ip Av-01Mfd 3.9.2; Bas-Ip Av-02D 3.9.2; Bas-Ip Av-02Fde 3.9.2; Bas-Ip Av-02Fdr 3.9.2; Bas-Ip Av-02Ide 3.9.2. Check the vendor advisory for mitigations.

References

• https://bas-ip.com/bsa-000001
• https://github.com/DrieVlad/BAS-IP-vulnerabilities
• https://bas-ip.com/bsa-000001
• https://github.com/DrieVlad/BAS-IP-vulnerabilities

Get alerted when CVE-2024-39220 or the next vulnerability affects your stack