CVE-2024-3765 — A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB

A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R80X30-PQ_8M. Affected by this vulnerability is an unknown functionality of the component Sofia Service. The manipulation w

01What is this vulnerability?

A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R80X30-PQ_8M. Affected by this vulnerability is an unknown functionality of the component Sofia Service. The manipulation with the input…

02Affected products

Vendor	Product	Versions
Xiongmai	AHB7804R	MH-V2 — 4.02.R11.24340142.10001.131900.00000, 4.02.R11.A8531149.10001.131900.00000, 4.02.R11.C6380171.11201.141900.00000, 4.03.R11.0000020X.11201.042300.0000005, 4.03.R11.4912720B.11201.142300.0000004, 4.03.R11.4912720D.11201.142300.0000004, 4.03.R11.4915714A.12201.142300.0000000, 5.00.R02.00030751.10010.348717.0000000
Xiongmai	AHB8004T	GL — 4.02.R11.24340142.10001.131900.00000, 4.02.R11.A8531149.10001.131900.00000, 4.02.R11.C6380171.11201.141900.00000, 4.03.R11.0000020X.11201.042300.0000005, 4.03.R11.4912720B.11201.142300.0000004, 4.03.R11.4912720D.11201.142300.0000004, 4.03.R11.4915714A.12201.142300.0000000, 5.00.R02.00030751.10010.348717.0000000
Xiongmai	AHB8008T	GL — 4.02.R11.24340142.10001.131900.00000, 4.02.R11.A8531149.10001.131900.00000, 4.02.R11.C6380171.11201.141900.00000, 4.03.R11.0000020X.11201.042300.0000005, 4.03.R11.4912720B.11201.142300.0000004, 4.03.R11.4912720D.11201.142300.0000004, 4.03.R11.4915714A.12201.142300.0000000, 5.00.R02.00030751.10010.348717.0000000
Xiongmai	AHB7004T	GS-V3 — 4.02.R11.24340142.10001.131900.00000, 4.02.R11.A8531149.10001.131900.00000, 4.02.R11.C6380171.11201.141900.00000, 4.03.R11.0000020X.11201.042300.0000005, 4.03.R11.4912720B.11201.142300.0000004, 4.03.R11.4912720D.11201.142300.0000004, 4.03.R11.4915714A.12201.142300.0000000, 5.00.R02.00030751.10010.348717.0000000
Xiongmai	AHB7004T	MHV2 — 4.02.R11.24340142.10001.131900.00000, 4.02.R11.A8531149.10001.131900.00000, 4.02.R11.C6380171.11201.141900.00000, 4.03.R11.0000020X.11201.042300.0000005, 4.03.R11.4912720B.11201.142300.0000004, 4.03.R11.4912720D.11201.142300.0000004, 4.03.R11.4915714A.12201.142300.0000000, 5.00.R02.00030751.10010.348717.0000000
Xiongmai	AHB8032F	LME — 4.02.R11.24340142.10001.131900.00000, 4.02.R11.A8531149.10001.131900.00000, 4.02.R11.C6380171.11201.141900.00000, 4.03.R11.0000020X.11201.042300.0000005, 4.03.R11.4912720B.11201.142300.0000004, 4.03.R11.4912720D.11201.142300.0000004, 4.03.R11.4915714A.12201.142300.0000000, 5.00.R02.00030751.10010.348717.0000000
Xiongmai	XM530_R80X30	PQ_8M — 4.02.R11.24340142.10001.131900.00000, 4.02.R11.A8531149.10001.131900.00000, 4.02.R11.C6380171.11201.141900.00000, 4.03.R11.0000020X.11201.042300.0000005, 4.03.R11.4912720B.11201.142300.0000004, 4.03.R11.4912720D.11201.142300.0000004, 4.03.R11.4915714A.12201.142300.0000000, 5.00.R02.00030751.10010.348717.0000000

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:

Open in Sigma generator →

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2024-04-14T23:00:05.199Z
• Last modified: 2024-08-08T20:19:23.996Z

09References

• vuldb.com — https://vuldb.com/?id.260605
• vuldb.com — https://vuldb.com/?ctiid.260605
• vuldb.com — https://vuldb.com/?submit.311903
• github.com — https://github.com/netsecfish/xiongmai_incorrect_access_control
• github.com — https://github.com/netsecfish/xiongmai_incorrect_access_control/blob/main/pocChe…