CVE-2024-41161

HIGH
Published Aug 8, 2024 Modified Aug 20, 2024 CWE-798

Description

Use of hard-coded credentials vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to bypass authentication using hard-coded administrator credentials. These accounts cannot be disabled.

Is your site exposed to CVE-2024-41161?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-798 CWE-798

Affected Products

Vendor Product
vonets var1200-h_firmware
vonets var1200-h
vonets var1200-l_firmware
vonets var1200-l
vonets var600-h_firmware
vonets var600-h
vonets vap11ac_firmware
vonets vap11ac
vonets vap11g-500s_firmware
vonets vap11g-500s
vonets vbg1200_firmware
vonets vbg1200
vonets vap11s-5g_firmware
vonets vap11s-5g
vonets vap11s_firmware
vonets vap11s
vonets var11n-300_firmware
vonets var11n-300
vonets vap11g-300_firmware
vonets vap11g-300
vonets vap11n-300_firmware
vonets vap11n-300
vonets vap11g_firmware
vonets vap11g
vonets vap11g-500_firmware
vonets vap11g-500
vonets vga-1000_firmware
vonets vga-1000

References

Frequently Asked Questions

What is CVE-2024-41161? +
Use of hard-coded credentials vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to bypass authentication using hard-coded administrator credentials. These accounts cannot be disabled. It has a CVSS v3.1 base score of 7.5 (HIGH).
How severe is CVE-2024-41161? +
CVE-2024-41161 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.
What products are affected by CVE-2024-41161? +
CVE-2024-41161 affects products from vonets, specifically: vap11ac, vap11ac_firmware, vap11g, vap11g-300, vap11g-300_firmware, vap11g-500, vap11g-500_firmware, vap11g-500s, vap11g-500s_firmware, vap11g_firmware, vap11n-300, vap11n-300_firmware, vap11s, vap11s-5g, vap11s-5g_firmware, vap11s_firmware, var11n-300, var11n-300_firmware, var1200-h, var1200-h_firmware, var1200-l, var1200-l_firmware, var600-h, var600-h_firmware, vbg1200, vbg1200_firmware, vga-1000, vga-1000_firmware. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-41161? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-42251

Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages. …
CVE-2026-61740

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset, …
CVE-2025-3426

We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is …
CVE-2025-4049

Use of hard-coded, the same among all vulnerable installations SQLite credentials vulnerability in SIGNUM-NET FARA allows to read and manipulate …
CVE-2025-4569

An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could …
CVE-2025-4570

An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-41161 — free, no signup required.