External risk intelligence

Inohom Nova Panel Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2024-6684

The affected product is a smart home or automation panel. Such devices are commonly deployed as network-accessible management interfaces, often intended for remote monitoring and control, which frequently leads to their exposure on local and wide-area networks.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a specific electronic control panel. The flaw permits unauthorized access to the system. This could potentially expose sensitive information or allow for the disruption of connected operations, impacting organizational security and continuity.

Affected electronic control panel
Allows unauthorized system access
Potential data exposure and operational disruption

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by exploiting an alternate path or channel. This vulnerability allows unauthorized access to the affected system. The system's administrative functions could then be compromised, leading to potential manipulation of connected devices or data.

Publicly accessible system.
Attacker bypasses authentication.
Attacker gains administrative control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows for authentication bypass on the inohom Nova Panel N7. The issue impacts systems through version 1.9.9.6. Notably, the vendor has indicated that the product is no longer supported, which could complicate remediation efforts. The potential business risk is considered high due to the critical severity score.

Likely attacker skill level: Low
Required access or conditions: Network access
Business risk or urgency: High

Operational Fix

Recommended remediation, mitigation, and detection steps

A critical vulnerability has been identified that permits authentication bypass through an alternate path or channel in the GST Electronics inohom Nova Panel N7. This could allow unauthorized access to systems. The vendor has indicated that the product is not supported.

Identify inohom Nova Panel N7 assets.
Reduce exposure or isolate affected devices.
Address vendor guidance and monitor activity.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the inohom Nova Panel N7 and what is it used for?

The inohom Nova Panel N7 is an electronic control panel used in smart home or automation systems. These panels typically serve as a central interface for managing and monitoring connected devices and operations within a home or facility.

How does CVE-2024-6684 bypass authentication?

CVE-2024-6684 is an Authentication Bypass Using an Alternate Path or Channel vulnerability. This means an attacker can gain access to the system without proper authentication by using an unintended method or route, bypassing the normal security checks.

What are the preconditions for an attacker to exploit CVE-2024-6684?

An attacker needs network access to exploit this vulnerability. The vulnerability is triggered through an alternate path or channel, suggesting that normal authentication methods are not necessarily required to initiate the bypass.

Who should be concerned about the inohom Nova Panel N7 vulnerability?

Organizations with internet-facing inohom Nova Panel N7 devices should be particularly concerned. Halo Surface Signal indicates that devices like this are commonly deployed as network-accessible management interfaces, increasing their potential exposure.

What should I do if I have an inohom Nova Panel N7?

First, identify all inohom Nova Panel N7 assets within your environment. Consider reducing their network exposure or isolating them if possible. You should also monitor for any vendor guidance, though the vendor has indicated the product is not supported.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.