« Back to list

CVE-2024-0860

Status: AnalyzedHigh (7.5)—

The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Softing — EdgeaggregatorSofting — Edgeconnector

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2024-0860",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-0860",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-15T16:34:23.355296Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Softing",
          "product": "edgeConnector",
          "versions": [
            {
              "status": "affected",
              "version": "Version 3.60"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Softing",
          "product": "edgeAggregator",
          "versions": [
            {
              "status": "affected",
              "version": "Version 3.60"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:softing:edgeconnector:3.60:*:*:*:*:*:*:*"
          ],
          "vendor": "softing",
          "product": "edgeconnector",
          "versions": [
            {
              "status": "affected",
              "version": "3.60"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:softing:edgeaggregator:3.60:*:*:*:*:*:*:*"
          ],
          "vendor": "softing",
          "product": "edgeaggregator",
          "versions": [
            {
              "status": "affected",
              "version": "3.60"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-03-14T21:15:50.640",
  "references": [
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-13",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-13",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "\nThe affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.\n\n"
    },
    {
      "lang": "es",
      "value": "El producto afectado es vulnerable a una transmisión de texto plano de información confidencial, lo que puede permitir a un atacante capturar paquetes para manipular sus propias solicitudes."
    }
  ],
  "lastModified": "2026-06-17T06:54:27.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:softing:edgeaggregator:3.60:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8510739-3F46-4F36-B4AF-62DEEDE566E5"
            },
            {
              "criteria": "cpe:2.3:a:softing:edgeconnector:3.60:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C85FF580-6FC4-4B5C-BCFE-07331237965E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}