NVD disclosure day

Published threat advisories for October 24, 2024

CVE-2024-48539

Neye3C Firmware Update Hardcoded Key Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A hardcoded encryption key in the Neye3C firmware update mechanism could allow an attacker to decrypt sensitive information and potentially gain unauthorized access or control of the device. This vulnerability is reachable over a network.

NVD published: October 24, 2024

CVE advisoryCRITICAL

CVE-2024-48538

Neye3C Firmware Update Access Control Information Disclosure.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

Incorrect access control in Neye3C's firmware update and download processes allows attackers to access sensitive information by analyzing the APK file's code and data. While the direct business impact is assessed as very unlikely, confirming relevance is recommended.

NVD published: October 24, 2024