vulnrichment
vulnrichment copied to clipboard
Removed Architecture from CVE-2024-5245 Version
Looking at CVE-2024-5245, I saw the CISA ADP had, what I thought to be, a questionable version string.
"affected": [
{
"cpes": [
"cpe:2.3:a:netgear:prosafe_network_management_system:1.7.0.34:*:*:*:*:*:*:*"
],
"vendor": "netgear",
"product": "prosafe_network_management_system",
"versions": [
{
"status": "affected",
"version": "1.7.0.34 x64"
}
],
"defaultStatus": "unknown"
}
],
Likely x64
should not be in the version string. If we look at the vendor advisory they only list 1.7.0.34
. The reporting CNA, ZDI, makes no mention of a specific architecture in their advisory (nor version - thanks ZDI), but considering the vulnerability appears to be default creds, I assume architecture doesn't really come into play.
The product does come in Win32 and Win64 variants, but I think if we believed only the Win64 version to be vulnerable that would be reflected in the CPE and not the version string.