CVE-2024-41684
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to capture cookies and compromise the targeted system.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.21%
- CWE
- CWE-614
- Published
- 2024-07-26
- Last modified
- 2026-03-13
Affected products
- SyroTech SyroTech SY-GPON-1110-WDONT router
Weakness type
Related vulnerabilities
- CVE-2026-65655 — Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy
- CVE-2026-15656 — IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret
- CVE-2026-48058 — nebula-mesh: Session and OIDC state cookies lack the Secure attribute
- CVE-2026-56581 — HCL MyCloud was affected with Cookie Attribute Path Not Set
- CVE-2024-23572 — HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may...
- CVE-2026-57948 — Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
- CVE-2026-46550 — NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags
- CVE-2026-53661 — boruta-server sent sensitive session cookies without the Secure attribute