1. EXECUTIVE SUMMARY
- CVSS v4 9.4
- ATTENTION: Exploitable from adjacent network/Low attack complexity
- Vendor: IOSiX
- Equipment: IO-1020 Micro ELD
- Vulnerabilities: Use of Default Credentials, Download of Code Without Integrity Check
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an adjacent attacker to take control of vehicle systems by connecting to and modifying the affected device.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following IOSiX products are affected:
- IO-1020 Micro ELD: Versions prior to 360
3.2 Vulnerability Overview
3.2.1 USE OF DEFAULT CREDENTIALS CWE-1392
IO-1020 Micro ELD uses a default WIFI password that could allow an adjacent attacker to connect to the device.
CVE-2024-30210 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.4 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
A CVSS v4 score has also been calculated for CVE-2024-30210. A base score of 8.5 has been calculated; the CVSS vector string is (CVSS4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H).
3.2.2 USE OF DEFAULT CREDENTIALS CWE-1392
Web server uses a default password for authentication.