What is the CVSS score of CVE-2024-3281?

CVE-2024-3281 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2024-3281?

Yes, a public proof-of-concept exploit is available for CVE-2024-3281. Prioritise patching immediately. EPSS: 0.5%.

Poly Ccx 350 CVE-2024-3281

HIGH

Missing Authentication for Critical Function (CWE-306)

2024-04-09 hp-security-alert@hp.com

Authentication Bypass Poly Ccx 350 Poly Ccx 400 Poly Ccx 500 Poly Ccx 505 Poly Ccx 600 Poly Ccx 700

8.8

CVSS 3.1 · Vendor: hp

Severity by source

Vendor (hp) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Primary rating from Vendor (hp) · only source for this CVE.

CVSS VectorVendor: hp

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

CVE Published

Apr 09, 2024 - 16:15 cve.org

HIGH 8.8

DescriptionCVE.org

A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not properly restrict access to a resource from an unauthorized actor.

AnalysisAI

A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authentication for Critical Function (CWE-306), which allows attackers to access critical functionality without authentication. A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not properly restrict access to a resource from an unauthorized actor. Affected products include: Hp Poly Ccx 350, Hp Poly Ccx 400, Hp Poly Ccx 500, Hp Poly Ccx 505, Hp Poly Ccx 600. Version information: prior to 8.1.3.1301.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Require authentication for all sensitive operations, implement defense in depth.