The CAYIN Technology CMS lacks proper access control, allowing unauthenticated remote attackers to download arbitrary CGI files.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Cayintech
  • Cms-20
  • Cms-60
  • Cms-se
  • Cms-se\(18.04\)
  • Cms-se\(22.04\)
  • Smp-2100
  • Smp-2200
  • Smp-2210
  • Smp-2300
  • Smp-2310
  • Smp-2400
  • Smp-6000
  • Smp-8000
  • Smp-8000qd
  • Smp-8100

No data.

No data.

References
Link Providers
https://resource1.cayintech.com/patch/ cve-icon cve-icon
https://www.twcert.org.tw/en/cp-139-8004-ed9aa-2.html cve-icon cve-icon
https://www.twcert.org.tw/tw/cp-132-8003-5543e-1.html cve-icon cve-icon
History

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00282}

 epss

{'score': 0.00373}

Fri, 16 Aug 2024 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Cayintech
Cayintech cms-20
Cayintech cms-60
Cayintech cms-se
Cayintech cms-se\(18.04\)
Cayintech cms-se\(22.04\)
Cayintech smp-2100
Cayintech smp-2200
Cayintech smp-2210
Cayintech smp-2300
Cayintech smp-2310
Cayintech smp-2400
Cayintech smp-6000
Cayintech smp-8000
Cayintech smp-8000qd
Cayintech smp-8100
CPEs cpe:2.3:h:cayintech:cms-20:11.0:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:cms-60:11.0:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:cms-se:11.0:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:cms-se\(18.04\):11.0:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:cms-se\(22.04\):11.0:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:smp-2100:3.0:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:smp-2200:*:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:smp-2210:*:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:smp-2300:*:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:smp-2310:*:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:smp-2400:4.0:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:smp-6000:3.0:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:smp-8000:3.0:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:smp-8000qd:3.0:*:*:*:*:*:*:*
cpe:2.3:h:cayintech:smp-8100:4.0:*:*:*:*:*:*:*
Vendors & Products Cayintech
Cayintech cms-20
Cayintech cms-60
Cayintech cms-se
Cayintech cms-se\(18.04\)
Cayintech cms-se\(22.04\)
Cayintech smp-2100
Cayintech smp-2200
Cayintech smp-2210
Cayintech smp-2300
Cayintech smp-2310
Cayintech smp-2400
Cayintech smp-6000
Cayintech smp-8000
Cayintech smp-8000qd
Cayintech smp-8100
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Aug 2024 04:00:00 +0000

Type Values Removed Values Added
Description The CAYIN Technology CMS lacks proper access control, allowing unauthenticated remote attackers to download arbitrary CGI files.
Title CAYIN Technology CMS - Sensitive File Download
Weaknesses CWE-552
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2024-08-14T03:52:43.673Z

Updated: 2024-08-16T15:46:19.420Z

Reserved: 2024-08-13T06:08:30.865Z

Link: CVE-2024-7729

cve-icon Vulnrichment

Updated: 2024-08-16T15:46:04.116Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-08-14T04:15:07.150

Modified: 2024-08-14T13:00:37.107

Link: CVE-2024-7729

cve-icon Redhat

No data.