CVE-2024-36391

The vulnerability lies in the way cryptographic keys are managed in the Milesight DeviceHub application. Improper implementation or storage of keys may allow an attacker to bypass authentication mechanisms, as well as intercept and potentially modify network traffic in a Man-In-The-Middle attack. The attack does not require user interaction or prior system privileges.

An attacker can gain unauthorized access to the system by bypassing authentication, and can intercept or modify transmitted data, leading to serious breach of confidentiality and integrity.

Apply patches available from the manufacturer in accordance with the references provided

Milesight DeviceHub — versions indicated in the manufacturer's references