{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38280", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-06-12T16:16:09.648Z", "datePublished": "2024-06-13T17:05:58.531Z", "dateUpdated": "2024-07-08T19:50:06.502Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Vigilant Fixed LPR Coms Box (BCAV1F2-C600)", "vendor": "Motorola Solutions", "versions": [{"lessThanOrEqual": "3.1.171.9", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "The Michigan State Police Michigan Cyber Command Center (MC3)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.</p><br>\n\n"}], "value": "An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "baseScore": 7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-313", "description": "CWE-313: Cleartext Storage in a File or on Disk", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-06-13T17:05:58.531Z"}, "references": [{"tags": ["government-resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>\n\n</p><p>Motorola Solutions recommends the following for each identified vulnerability:</p><p></p><p>CVE-2024-38280:</p><ul><li>Apply encryption to all Criminal Justice Information (CJI) data.</li><li>Apply full disk encryption with LUKS encryption standards and add password protection<br>to the GRUB Bootloader.</li><li>Perform column-level encryption for sensitive data in the database.</li></ul><p>All devices shipped after May 10, 2024 are already using full disk encryption. All devices that<br>are not able to have full disk encryption applied have had all CJI data encrypted. No further<br>actions are required by customers.</p>\n\n<br>"}], "value": "Motorola Solutions recommends the following for each identified vulnerability:\n\n\n\nCVE-2024-38280:\n\n * Apply encryption to all Criminal Justice Information (CJI) data.\n * Apply full disk encryption with LUKS encryption standards and add password protection\nto the GRUB Bootloader.\n * Perform column-level encryption for sensitive data in the database.\n\n\nAll devices shipped after May 10, 2024 are already using full disk encryption. All devices that\nare not able to have full disk encryption applied have had all CJI data encrypted. No further\nactions are required by customers."}], "source": {"discovery": "UNKNOWN"}, "title": "Cleartext Storage in a File or on Disk in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "motorolasolutions", "product": "vigilant_fixed_lpr_coms_box", "cpes": ["cpe:2.3:a:motorolasolutions:vigilant_fixed_lpr_coms_box:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.171.9", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-27T20:16:58.305340Z", "id": "CVE-2024-38280", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-08T19:50:06.502Z"}}]}}

{"descriptions": [{"lang": "en", "value": "An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text."}], "id": "CVE-2024-38280", "lastModified": "2024-06-13T18:35:19.777", "metrics": {}, "published": "2024-06-13T17:15:51.477", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-313"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}

{}