CVE-2024-39220: Bas-IP Aa-07bd

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request.

Affected products

• Bas-IP Aa-07bd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP Aa-07bdi: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-01bd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-01d: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-01ed: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-01kd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-01md: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-01mfd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-02d: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-02fde: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-02fdr: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-02ide: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-02idr: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-02ipd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-03bd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-03d: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-04afd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-04asd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-04fd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-04sd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-05fd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP AV-05sd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP BA-04bd: before 3.9.2 (fixed in 3.9.2)
• Bas-IP BA-04md: before 3.9.2 (fixed in 3.9.2)
• Bas-IP BA-08bd: before 3.9.2 (fixed in 3.9.2)
• and 4 more

Published 2024-07-03. Last modified 2026-06-17.