What’s Vulnerable › Vulnerabilities

CVE-2024-42001: Vonets WiFi Bridges Forced Browsing

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-12 · updated 2026-06-17
• Weakness: CWE-425

Description

An improper authentication vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior enables an unauthenticated remote attacker to bypass authentication via a specially crafted direct request when another user has an active session.

Affected products

• Vonets Vap11Ac Firmware: through 3.3.23.6.9
• Vonets Vap11G-300 Firmware: through 3.3.23.6.9
• Vonets Vap11G-500 Firmware: through 3.3.23.6.9
• Vonets Vap11G-500S Firmware: through 3.3.23.6.9
• Vonets Vap11G Firmware: through 3.3.23.6.9
• Vonets Vap11N-300 Firmware: through 3.3.23.6.9
• Vonets Vap11S-5G Firmware: through 3.3.23.6.9
• Vonets Vap11S Firmware: through 3.3.23.6.9
• Vonets Var11N-300 Firmware: through 3.3.23.6.9
• Vonets Var1200-H Firmware: through 3.3.23.6.9
• Vonets Var1200-L Firmware: through 3.3.23.6.9
• Vonets Var600-H Firmware: through 3.3.23.6.9
• Vonets Vbg1200 Firmware: through 3.3.23.6.9
• Vonets Vga-1000 Firmware: through 3.3.23.6.9

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08

Get alerted when CVE-2024-42001 or the next vulnerability affects your stack