CVE-2024-40090
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in Vilo 5 Mesh WiFi System version 5.16.1.33 and earlier allows remote information disclosure. An unauthenticated attacker can send a GET request to the index page, leaking memory addresses of uClibc and the stack.
Risk Assessment
The risk is that an attacker can use the leaked memory addresses to perform further attacks, such as taking control of the device or escalating privileges within the network.
Recommendation
It is recommended to immediately update the firmware of the Vilo 5 Mesh WiFi System to a version later than 5.16.1.33, which includes a fix for this vulnerability.
Original NVD description (English source)
Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Information Disclosure. An information leak in the Boa webserver allows remote, unauthenticated attackers to leak memory addresses of uClibc and the stack via sending a GET request to the index page.