CVE-2024-58337
📋 TL;DR
The Akuvox Smart Intercom S539 has an improper access control vulnerability that allows users with 'User' privileges to modify API settings and configurations. This enables privilege escalation to administrative access. Organizations using the Akuvox Smart Intercom S539 are affected.
💻 Affected Systems
- Akuvox Smart Intercom S539
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control over the intercom system, potentially compromising building security systems, accessing video feeds, and manipulating access controls.
Likely Case
Unauthorized users escalate privileges to admin level, modify system configurations, and potentially disable security features.
If Mitigated
With proper network segmentation and access controls, impact is limited to the intercom system itself without lateral movement.
🎯 Exploit Status
Exploitation requires valid user credentials but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Monitor Akuvox security advisories for patch availability. 2. Apply patch when released. 3. Verify privilege separation after patching.
🔧 Temporary Workarounds
Network Segmentation
allIsolate intercom systems from critical networks and limit access to authorized IPs only.
Access Control Review
allAudit and restrict user privileges to minimum necessary access.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate intercom systems
- Monitor API access logs for unauthorized configuration changes
🔍 How to Verify
Check if Vulnerable:
Test if a user account can access /services/http/api endpoints intended for administrators.Check Version:
Check device web interface or console for firmware versionVerify Fix Applied:
Verify that user accounts can no longer modify API settings or configurations.📡 Detection & Monitoring
Log Indicators:
- Unauthorized API configuration changes from user accounts
- Multiple privilege escalation attempts
Network Indicators:
- Unusual API calls to administrative endpoints from non-admin IPs
SIEM Query:
source="akuvox_intercom" AND (event_type="config_change" OR api_endpoint="/services/http/api/*") AND user_role="user"🔗 References
- https://cxsecurity.com/issue/WLB-2024110042
- https://packetstormsecurity.com/files/182870/
- https://www.vulncheck.com/advisories/akuvox-smart-intercom-s-improper-access-control-via-serviceshttpapi
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5862.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5862.php
