CISA Warns Critical Vulnerabilities in Vonets WiFi Bridge Devices, No Patch Available

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a security advisory detailing multiple critical vulnerabilities discovered in Vonets WiFi Bridge devices. These vulnerabilities, which could allow attackers to execute arbitrary code, disclose sensitive information, or disrupt device functionality, pose a significant threat to the security of industrial and commercial networks relying on these devices. Despite the severity of the flaws, Vonets has not responded to CISA’s requests for collaboration on mitigation strategies, leaving users in a precarious position.

Vulnerabilities and Potential Impact:

The identified vulnerabilities encompass a wide range of severity, including:

• CVE-2024-41161 (CVSSv4 8.7): A Use of Hard-coded Credentials flaw allows unauthenticated attackers to bypass authentication and gain full access to the device using pre-set administrator credentials. These credentials cannot be disabled, making this a particularly dangerous vulnerability.
• CVE-2024-29082 (CVSSv4 8.8): An Improper Access Control issue enables attackers to bypass authentication and perform a factory reset on the device via unprotected endpoints, potentially causing service disruptions and loss of configuration data.
• CVE-2024-41936 (CVSSv4 8.7): A Directory Traversal vulnerability allows attackers to read arbitrary files on the device, bypassing authentication mechanisms and exposing sensitive information.
• CVE-2024-37023 (CVSSv4 9.4): OS Command Injection vulnerabilities allow authenticated attackers to execute arbitrary operating system commands on the device, potentially giving them control over the device’s operation.
• CVE-2024-39815 (CVSSv4 8.7): An Improper Handling of Exceptional Conditions flaw could allow attackers to cause a Denial-of-Service (DoS) condition by sending specially crafted HTTP requests to the device.
• CVE-2024-39791 (CVSSv4 10): The most critical vulnerability, a Stack-Based Buffer Overflow, enables attackers to execute arbitrary code remotely, potentially taking full control of the device without authentication.
• CVE-2024-42001 (CVSSv4 6.1): An Improper Authentication flaw allows attackers to bypass authentication by sending specially crafted requests when another user session is active.

Affected Products

The vulnerabilities affect a wide range of Vonets products, including but not limited to the following models:

• VAR1200-H, VAR1200-L, VAR600-H, VAP11AC
• VAP11G-500S, VBG1200, VAP11S-5G, VAP11S
• VAR11N-300, VAP11G-300, VAP11N-300, VAP11G
• VAP11G-500, VAP11AC, VGA-1000

All affected products run software versions 3.3.23.6.9 and prior.

CISA’s Recommendations

Given the lack of response from Vonets, CISA has issued several recommendations to help organizations mitigate the risk posed by these vulnerabilities:

• Minimize Network Exposure: Ensure that all control system devices and networks are not accessible from the internet. This minimizes the risk of unauthorized access.
• Isolate Control Systems: Place control system networks and remote devices behind firewalls and separate them from business networks to prevent cross-network attacks.
• Secure Remote Access: When remote access is necessary, use more secure methods such as Virtual Private Networks (VPNs). However, be aware that VPNs themselves may have vulnerabilities and should be kept up to date. The security of the VPN is also dependent on the security of the connected devices.

CISA also emphasizes the importance of conducting proper impact analysis and risk assessments before deploying any defensive measures to ensure they do not inadvertently disrupt operations.

While no public exploitation has been reported, the criticality of these vulnerabilities necessitates immediate action. Organizations and individuals must prioritize the security of their networks and take proactive steps to mitigate the risk of potential attacks.

Related Posts:

• ServiceNow Security Alert: Critical Vulnerabilities Expose Businesses to RCE and Data Breaches
• CVE-2024-36072 (CVSS 10): Unauthenticated RCE Flaw in CoSoSys Endpoint Protector
• CVE-2024-21586: Juniper SRX Vulnerability Leaves Networks Open to Attack
• Pandora FMS Reveals High-Risk Security Flaws Affecting 50,000+ Installations