← Vulnerability feed

Vulnerability record · CVE-2024-41685 · published 26 July 2024

CVE-2024-41685: Syrotech sy-gpon-1110-wdont firmware incorrect permission assignment vulnerability

Syrotech · Sy Gpon 1110 Wdont Firmware

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to capture cookies and obtain sensitive information on the targeted system.

6.9 CVSS 4.0 Medium EPSS 0.50% · top 59.9% CWE-1004 · CWE-1004CWE-732 · Incorrect permission assignment
6.9CVSS 4.0 base score
0.50%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to capture cookies and obtain sensitive information on the targeted system.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225 Third Party Advisory
https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0225

Track CVE-2024-41685 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.0CVE-2025-63729Syrotech sy-gpon-1110-wdont firmware information exposure vulnerabilityAn issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SS…EPSS 0.09%8.6CVE-2024-41687Syrotech sy-gpon-1110-wdont firmware cleartext transmission vulnerabilityThis vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text. A remote attacker could exploit this v…EPSS 0.31%7.3CVE-2024-41686Syrotech sy-gpon-1110-wdont firmware vulnerabilityThis vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could exploit t…EPSS 0.16%7.0CVE-2024-41688Syrotech sy-gpon-1110-wdont firmware cleartext storage of sensitive data vulnerabilityThis vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firm…EPSS 0.11%7.0CVE-2024-41690Syrotech sy-gpon-1110-wdont firmware cleartext storage of sensitive data vulnerabilityThis vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext within the r…EPSS 0.15%7.0CVE-2024-41691Syrotech sy-gpon-1110-wdont firmware cleartext storage of sensitive data vulnerabilityThis vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem as…EPSS 0.15%6.9CVE-2024-41684Syrotech sy-gpon-1110-wdont firmware vulnerabilityThis vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web m…EPSS 0.21%5.2CVE-2024-41689Syrotech sy-gpon-1110-wdont firmware hard-coded credentials vulnerabilityThis vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ data…EPSS 0.15%

Source: NIST National Vulnerability Database (record CVE-2024-41685), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.