Read the docs
TI-2024-02241 Aliases CVE-2024-2413GHSA-gpg3-v7vj-4v8w

Intumit SmartRobot - Use of Hard-coded Cryptographic Key

Priority MEDIUM 50CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timestamp to generate an authentication code. With this authentication code, they can obtain administrator privileges and subsequently execute arbitrary code on the remote server using built-in system functionality.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00574 47th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
INTUMITSmartRobotearlier version – v6.1.2-202212tw—No fix listedCNA
  • SmartRobot VendorINTUMIT Affected earlier version – v6.1.2-202212tw Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:intumit:smartrobot:*:*:*:*:*:*:*:*before 6.2.0-202303TWVulnerableINTUMIT
  • cpe:2.3:a:intumit:smartrobot:*:*:*:*:*:*:*:* Versions before 6.2.0-202303TW Vulnerable ·INTUMIT

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-2413
  2. 2026-10-03 Alias added: GHSA-gpg3-v7vj-4v8w

References

Advisory 1

  • TI-2024-11737 Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection') CVSS 4.0CRITICAL 9.3
  • TI-2024-00510 Intumit inc. SmartRobot - Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-03141 INTUMIT SmartRobot - Server-Side Request Forgery CVSS 3.1HIGH 7.5
  • TI-2024-08142 INTUMIT SmartRobot - Cross-site Scripting CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences