CVE-2026-24455
BaseFortify
Publication date: 2026-02-20
Last updated on: 2026-02-20
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-319 | The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists because the embedded web interface of the device does not support HTTPS or TLS for authentication and instead uses HTTP Basic Authentication.
Although the traffic is encoded, it is not encrypted, which means that user credentials can be exposed to passive interception by attackers who are on the same network.
How can this vulnerability impact me? :
Because the authentication traffic is not encrypted, attackers on the same network can intercept user credentials.
This can lead to unauthorized access to the device's web interface, potentially compromising the device's security.
The CVSS base score of 7.5 indicates a high severity impact on confidentiality, meaning sensitive information can be exposed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for unencrypted HTTP Basic Authentication exchanges to the device's embedded web interface. Since the interface does not support HTTPS/TLS, credentials are transmitted in clear text (encoded but not encrypted), making them visible to passive interception.
To detect this on your network, you can use network packet capture tools such as tcpdump or Wireshark to inspect HTTP traffic for Basic Authentication headers.
- Use tcpdump to capture HTTP traffic on the relevant network interface: tcpdump -i <interface> -A 'tcp port 80'
- In Wireshark, filter traffic with the display filter: http.authbasic
- Look for HTTP requests containing the 'Authorization: Basic' header, which indicates Basic Authentication credentials sent in clear text.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting network access to the device's web interface to trusted and secure networks only, such as isolating the device on a separate VLAN or using firewall rules to limit access.
Additionally, avoid using the device's web interface over untrusted or public networks since the credentials are exposed in unencrypted HTTP traffic.
If possible, use network-level encryption such as VPN tunnels to protect traffic to the device until the vendor provides support for HTTPS/TLS.