Read the docs
TI-2024-27749 Aliases CVE-2024-41689GHSA-92vm-7577-pphj

Hard-coded credentials in SyroTech SY-GPON-1110-WDONT router

Priority LOW 23CWE-798Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
High · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798 and CWE-312.

Summary

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext WPA/ WPS credentials on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to bypass WPA/ WPS and gain access to the Wi-Fi network of the targeted system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00153 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SyroTechSyroTech SY-GPON-1110-WDONT router3.1.02-231102—No fix listedCNA
  • SyroTech SY-GPON-1110-WDONT router VendorSyroTech Affected 3.1.02-231102 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:syrotech:sy-gpon-1110-wdont_firmware:3.1.02-231102:*:*:*:*:*:*:*3.1.02-231102VulnerableSyroTech
cpe:2.3:h:syrotech:sy-gpon-1110-wdont:-:*:*:*:*:*:*:*not specified by NVDRunning onSyroTech
  • cpe:2.3:o:syrotech:sy-gpon-1110-wdont_firmware:3.1.02-231102:*:*:*:*:*:*:* Versions 3.1.02-231102 Vulnerable ·SyroTech
  • cpe:2.3:h:syrotech:sy-gpon-1110-wdont:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·SyroTech

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41689
  2. 2026-10-03 Alias added: GHSA-92vm-7577-pphj

References

Advisory 1

  • TI-2025-39443 An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing… CVSS 3.1CRITICAL 9.0
  • TI-2024-27747 Cleartext transmission of sensitive information in SyroTech SY-GPON-1110-WDONT router CVSS 4.0HIGH 8.6
  • TI-2024-27745 Cookie Without HTTPOnly Flag Set Vulnerability CVSS 4.0MEDIUM 6.9
  • TI-2024-27746 Password Policy Bypass Vulnerability CVSS 4.0HIGH 7.3
  • TI-2024-27750 Default Credential Storage in Plaintext Vulnerability CVSS 4.0HIGH 7.0
  • TI-2024-27751 Insecure storage of sensitive information in SyroTech SY-GPON-1110-WDONT router CVSS 4.0HIGH 7.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences