This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user passwords, which could lead to gain unauthorized access and compromise other user accounts.
The API endpoint responsible for login does not implement any restrictions on excessive failed authentication attempts (CWE-307). An attacker can automatically and without limit send successive login requests with different password combinations. The lack of mechanisms such as account lockout, CAPTCHA, or rate limiting means that a brute force attack can be conducted unimpeded until the correct password is guessed.
An attacker can gain unauthorized access to user accounts in the system, and after taking over access — compromise the confidentiality, integrity, and availability of data stored in the system.
Patches available from the manufacturer should be applied according to references. Additionally, it is recommended to implement mechanisms limiting the number of login attempts (rate limiting, account lockout after a specified number of failed attempts) and to consider implementing multi-factor authentication (MFA).
Reedos aiM-Star version 2.0.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XReedos Aim Star
APPReedos2.0.1
Related vulnerabilities
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API ...
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to transmission of sensitive information in pla...
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing rate limiting on OTP requests in cer...
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper validation of the ‘mode’ parameter ...