CVE-2024-0390

INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access to manage and read parameters of the recuperation unit "reQnet iZZi".This issue affects "iZZi connect" application versions before 2024010401.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert.pl/en/posts/2024/02/CVE-2024-0390/	Third Party Advisory
https://cert.pl/posts/2024/02/CVE-2024-0390/	Third Party Advisory
https://cert.pl/en/posts/2024/02/CVE-2024-0390/	Third Party Advisory
https://cert.pl/posts/2024/02/CVE-2024-0390/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:inprax:izzi_connect:*:*:*:*:*:android:*:*

History

23 Jan 2025, 17:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
First Time		Inprax izzi Connect Inprax
References	~~() https://cert.pl/en/posts/2024/02/CVE-2024-0390/ -~~	() https://cert.pl/en/posts/2024/02/CVE-2024-0390/ - Third Party Advisory
References	~~() https://cert.pl/posts/2024/02/CVE-2024-0390/ -~~	() https://cert.pl/posts/2024/02/CVE-2024-0390/ - Third Party Advisory
CPE		cpe:2.3:a:inprax:izzi_connect::::::android::*

Information

Published : 2024-02-15 10:15

Updated : 2025-03-13 18:15

NVD link : CVE-2024-0390

Mitre link : CVE-2024-0390

CVE.ORG link : CVE-2024-0390

JSON object : View

Products Affected

inprax

izzi_connect

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2024-0390", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "published": "2024-02-15T10:15:09.043", "references": [{"url": "https://cert.pl/en/posts/2024/02/CVE-2024-0390/", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://cert.pl/posts/2024/02/CVE-2024-0390/", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://cert.pl/en/posts/2024/02/CVE-2024-0390/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cert.pl/posts/2024/02/CVE-2024-0390/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-798"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "INPRAX \"iZZi connect\" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access to manage and read parameters of the recuperation unit \"reQnet iZZi\".This issue affects \"iZZi connect\" application versions before 2024010401.\n\n"}, {"lang": "es", "value": "La aplicaci\u00f3n INPRAX \"iZZi connect\" en Android contiene credenciales de cola MQTT codificadas. Los dispositivos de recuperaci\u00f3n f\u00edsica correspondientes utilizan la misma cola MQTT. La explotaci\u00f3n de esta vulnerabilidad podr\u00eda permitir el acceso no autorizado para administrar y leer los par\u00e1metros de la unidad de recuperaci\u00f3n \"reQnet iZZi\". Este problema afecta a las versiones de la aplicaci\u00f3n \"iZZi connect\" anteriores a 2024010401."}], "lastModified": "2025-03-13T18:15:36.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:inprax:izzi_connect:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "DFEEB825-97A4-4A8E-A606-58A9762A974E", "versionEndExcluding": "2024010401"}], "operator": "OR"}]}], "sourceIdentifier": "cvd@cert.pl"}