CVE-2024-36388

An attacker can access critical functions of the Milesight DeviceHub platform without possessing any credentials. The lack of authentication mechanisms (CWE-305) and access controls (CWE-306) enables privileged operations to be invoked directly over the network without requiring user interaction. The attack vector is network-based, requires no complex conditions or any privileges.

An attacker can gain full control over the system, including access to sensitive data, ability to modify it, and disrupt service availability — which corresponds to maximum scores for confidentiality, integrity, and availability on the CVSS scale.

Apply patches available from the manufacturer according to the references. It is also recommended to restrict network access to DeviceHub administrative interfaces using a firewall and implement network segmentation until the patch is deployed.

Milesight DeviceHub and Canonical Ubuntu Linux — versions indicated in the manufacturer's references