CVE-2024-45370

An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2117
https://www.socomec.fr/sites/default/files/2025-11/CVE-2024-45370---ECS-2610---CVSS31_VULNERABILITIES_2025-11-19-09-45-29_English_PLURI_3.pdf
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2117

Configurations

No configuration.

History

26 Sep 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de omisión de autenticación existe en la funcionalidad de gestión de perfiles de usuario de Socomec Easy Config System 2.6.1.0. Un registro de base de datos especialmente diseñado puede conducir a acceso no autorizado. Un atacante puede modificar una base de datos local para activar esta vulnerabilidad.

Information

Published : 2025-12-01 16:15

Updated : 2026-09-26 21:10

NVD link : CVE-2024-45370

Mitre link : CVE-2024-45370

CVE.ORG link : CVE-2024-45370

JSON object : View

Products Affected

No product.

CWE

CWE-302

Authentication Bypass by Assumed-Immutable Data

{"id": "CVE-2024-45370", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-45370", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-01T20:22:50.772602Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.0}]}, "affected": [{"source": "talos-cna@cisco.com", "affectedData": [{"vendor": "Socomec", "product": "Easy Config System", "versions": [{"status": "affected", "version": "2.6.1.0"}]}]}], "published": "2025-12-01T16:15:49.757", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2117", "source": "talos-cna@cisco.com"}, {"url": "https://www.socomec.fr/sites/default/files/2025-11/CVE-2024-45370---ECS-2610---CVSS31_VULNERABILITIES_2025-11-19-09-45-29_English_PLURI_3.pdf", "source": "talos-cna@cisco.com"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2117", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-302"}]}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n existe en la funcionalidad de gesti\u00f3n de perfiles de usuario de Socomec Easy Config System 2.6.1.0. Un registro de base de datos especialmente dise\u00f1ado puede conducir a acceso no autorizado. Un atacante puede modificar una base de datos local para activar esta vulnerabilidad."}], "lastModified": "2026-09-26T21:10:00.130", "sourceIdentifier": "talos-cna@cisco.com"}