CVE-2024-8888
📋 TL;DR
An attacker on the same network as a vulnerable CIRCUTOR Q-SMT device can steal authentication tokens that never expire, allowing unrestricted access to the web application. This affects CIRCUTOR Q-SMT devices running firmware version 1.0.4. The vulnerability enables persistent unauthorized access once tokens are obtained.
💻 Affected Systems
- CIRCUTOR Q-SMT
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Q-SMT device allowing attackers to manipulate power management settings, disrupt operations, or use as a foothold into industrial control networks.
Likely Case
Unauthorized access to the web interface leading to configuration changes, data theft, or service disruption.
If Mitigated
Limited impact if network segmentation prevents attacker access and tokens are regularly cleared.
🎯 Exploit Status
Exploitation requires network access but token theft methods are well-known (network sniffing, browser storage access).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with CIRCUTOR for updated firmware
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-circutor-products
Restart Required: Yes
Instructions:
1. Contact CIRCUTOR for updated firmware. 2. Backup current configuration. 3. Apply firmware update via web interface or local method. 4. Verify update and restore configuration if needed.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Q-SMT devices on separate VLANs with strict access controls
Force Token Expiration
allImplement script to clear browser storage and force re-authentication regularly
🧯 If You Can't Patch
- Implement strict network segmentation to prevent unauthorized access to Q-SMT network segments
- Monitor for unusual authentication patterns and implement session timeout at proxy level
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: Settings > System InformationCheck Version:
Check via web interface or consult device documentation for CLI commandsVerify Fix Applied:
Verify firmware version is updated beyond 1.0.4 and test that tokens expire after session timeout📡 Detection & Monitoring
Log Indicators:
- Multiple authentication attempts from new IPs
- Configuration changes from unexpected sources
- Session tokens being used from multiple IPs
Network Indicators:
- Unusual traffic patterns to Q-SMT web interface
- Token values in cleartext network captures
SIEM Query:
source="q-smt-logs" AND (event_type="auth" AND src_ip NOT IN allowed_ips) OR (event_type="config_change" AND user!=expected_user)