CVE-2024-3688

Name of the Vulnerable Software and Affected Versions Xiamen Four-Faith RMP Router Management Platform version 5.2.2

Description A critical issue has been found in the Xiamen Four-Faith RMP Router Management Platform. The problem affects the file /Device/Device/GetDeviceInfoList?deviceCode=&searchField=&deviceState=. The manipulation of the groupId argument leads to SQL injection. This issue can be exploited remotely. The details of the exploit have been made public.

Recommendations For Xiamen Four-Faith RMP Router Management Platform version 5.2.2, as a temporary workaround, consider restricting access to the /Device/Device/GetDeviceInfoList API endpoint to minimize the risk of exploitation. Avoid using the groupId argument in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.