TI-2024-01507 Aliases CVE-2024-1623 GHSA-p594-wh4r-v877

Insufficient session timeout vulnerability in Sagemcom router

LOW 35CWE-613Published 2024-03-14 · Updated 2024-08-28

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-613.

Summary

Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not handle session details correctly.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00179 7th percentileScored 2026-11-07

Fix Fixed FAST3686 V2 Vodafone (Sagemcom): FAST3686_ONO-SIP_3.709.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Sagemcom	FAST3686 V2 Vodafone	before FAST3686_ONO-SIP_3.709.2	FAST3686_ONO-SIP_3.709.2	Patch available	CNA

FAST3686 V2 Vodafone VendorSagemcom Affected before FAST3686_ONO-SIP_3.709.2 Fixed in FAST3686_ONO-SIP_3.709.2 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:sagemcom:f\@st_3686_firmware::::::::	before 3.709.2	Vulnerable	Sagemcom
cpe:2.3:h:sagemcom:f\@st_3686:v2:::::::*	v2	Running on	Sagemcom

cpe:2.3:o:sagemcom:f\@st_3686_firmware:*:*:*:*:*:*:*:* Versions before 3.709.2 Vulnerable ·Sagemcom
cpe:2.3:h:sagemcom:f\@st_3686:v2:*:*:*:*:*:*:* Versions v2 Running on ·Sagemcom

Remediation

Fix · CNA FAST3686 V2 Vodafone (Sagemcom) Fixed in FAST3686_ONO-SIP_3.709.2

Timeline

2026-10-02 Threatist record created from CVE-2024-1623
2026-10-03 Alias added: GHSA-p594-wh4r-v877

References

Advisory 1

https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-session-timeout-vulnerability-sagemcom-router

TI-2019-14043 Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow… CVSS 3.1HIGH 8.8
TI-2025-21043 Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st… CVSS 3.1CRITICAL 9.8
TI-2021-02310 Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI. CVSS 3.1CRITICAL 9.8
TI-2020-14160 Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences