CVE-2024-40091
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Vilo 5 Mesh WiFi System version 5.16.1.33 and earlier lacks authentication in the Boa webserver, allowing remote, unauthenticated attackers to retrieve logs containing sensitive system information.
Risk Assessment
The risk involves potential leakage of sensitive system information such as network configuration or credentials, which could facilitate further attacks on the infrastructure.
Recommendation
Immediately update the Vilo 5 Mesh WiFi System firmware to a version newer than 5.16.1.33 that fixes this vulnerability, and restrict access to the Boa webserver to trusted networks only.
Original NVD description (English source)
Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve logs with sensitive system.