CVE-2024-58337

Description

Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations. Attackers can exploit this vulnerability to escalate privileges and gain unauthorized access to administrative functionalities.

CVSS v3.1 Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness Type (CWE)

CWE-862 Missing Authorization

Affected Products

Vendor	Product	Versions
akuvox	s539_firmware	All
akuvox	s539	All
akuvox	s532_firmware	All
akuvox	s532	All
akuvox	x916_firmware	All
akuvox	x916	All
akuvox	x915_firmware	All
akuvox	x915	All
akuvox	x912_firmware	All
akuvox	x912	All
akuvox	r29_firmware	All
akuvox	r29	All
akuvox	e16c_firmware	All
akuvox	e16c	All
akuvox	r20k-2_firmware	All
akuvox	r20k-2	All
akuvox	r20a-2_firmware	All
akuvox	r20a-2	All
akuvox	c313w-2_firmware	All
akuvox	c313w-2	All
akuvox	ns-2_firmware	All
akuvox	ns-2	All
akuvox	nc-2_firmware	All
akuvox	nc-2	All
akuvox	nx-2_firmware	All
akuvox	nx-2	All

References

Other References

https://cxsecurity.com/issue/WLB-2024110042 https://packetstormsecurity.com/files/182870/ https://www.vulncheck.com/advisories/akuvox-smart-intercom-s-improper-access-control-via-serviceshttpapi https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5862.php https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5862.php

Frequently Asked Questions

What is CVE-2024-58337? +

Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations. Attackers can exploit this vulnerability to escalate privileges and gain unauthorized access to administrative functionalities. It has a CVSS v3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2024-58337? +

CVE-2024-58337 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-58337? +

CVE-2024-58337 affects products from akuvox, specifically: c313w-2, c313w-2_firmware, e16c, e16c_firmware, nc-2, nc-2_firmware, ns-2, ns-2_firmware, nx-2, nx-2_firmware, r20a-2, r20a-2_firmware, r20k-2, r20k-2_firmware, r29, r29_firmware, s532, s532_firmware, s539, s539_firmware, x912, x912_firmware, x915, x915_firmware, x916, x916_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-58337? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-40570

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` …

CVE-2026-41128

Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the `actionSavePermissions()` endpoint allows a user with …

CVE-2024-43662

The <redacted>.exe or <redacted>.exe CGI binary can be used to upload arbitrary files to /tmp/upload/ or /tmp/ respectively as any …

CVE-2026-42337

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a broken access control vulnerability …

CVE-2026-48592

Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution. The handle_event("save-job", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does …

CVE-2026-40480

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoint loads and returns person …