CVE-2012-2974 The web interface on the SMC SMC8024L2 switch allows remote attackers to bypass authentication and obtain administrative access via a direct request to a .html file under (1) status/, (2) system/, (3)...

HighCVSS 10.0 EPSS 2.6%

Published: 2012-07-19 18:00
Updated: 2026-06-17 02:42
Exploit status: No public exploit known

Description

The web interface on the SMC SMC8024L2 switch allows remote attackers to bypass authentication and obtain administrative access via a direct request to a .html file under (1) status/, (2) system/, (3) ports/, (4) trunks/, (5) vlans/, (6) qos/, (7) rstp/, (8) dot1x/, (9) security/, (10) igmps/, or (11) snmp/.

Affected products

Product	Affected versions	Fixed in
smc8024l2 switch	All versions	No fix listed

References

VU#377915 third-party-advisory us-government-resource
1027285 vdb-entry

CVSS v2.0

10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Weakness & likelihood

EPSS (exploitation probability, 30 days): 2.62% (percentile 85.7)
CWE: CWE-287

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.