CVE-2024-0305: Ncast Information Disclosure Vulnerability

CVE-2024-0305 Overview

CVE-2024-0305 is an information disclosure vulnerability affecting Guangzhou Yingke Electronic Technology Ncast versions up to 2017. The flaw resides in unspecified functionality within the /manage/IPSetup.php file, accessible through the Guest Login component. Remote attackers can manipulate this endpoint to extract sensitive information without authentication or user interaction. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances. This issue is tracked as VulDB identifier VDB-249872 and is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact

Unauthenticated remote attackers can retrieve sensitive configuration data from Ncast devices, enabling reconnaissance for follow-on attacks against affected systems.

Affected Products

• Guangzhou Yingke Electronic Technology Ncast (all versions up to 2017)
• ncast_project:ncast component, Guest Login module
• Deployments exposing the /manage/IPSetup.php endpoint to untrusted networks

Discovery Timeline

• 2024-01-08 - CVE-2024-0305 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0305

Vulnerability Analysis

The vulnerability stems from improper access control on the /manage/IPSetup.php resource within the Ncast management interface. The Guest Login component fails to enforce authentication or authorization on requests targeting this script. Attackers can send crafted HTTP requests directly to the endpoint and retrieve information that should be restricted to administrators.

The issue maps to [CWE-200], indicating that the application exposes sensitive data to actors without proper privilege checks. Because the attack requires no privileges, no user interaction, and can be launched over the network, exposed devices face a high probability of automated scanning and exploitation. The publicly available EPSS estimate places this vulnerability in the top percentile for likelihood of exploitation activity, reflecting the disclosed proof-of-concept and trivial exploitation path.

Root Cause

The root cause is a missing authorization check on the IPSetup.php handler. The Guest Login flow exposes administrative information without validating session state or user role. The application treats the endpoint as a public resource even though it returns sensitive system configuration data.

Attack Vector

An unauthenticated attacker issues an HTTP request to /manage/IPSetup.php on a reachable Ncast device. The server responds with information that can include network configuration or other sensitive fields. The attacker uses this data to map the target environment and prepare additional attacks against the device or adjacent infrastructure.

No verified exploit code is reproduced here. Technical details and a public write-up are available in the GitHub Logic Vulnerability Report and the VulDB entry for VDB-249872.

Detection Methods for CVE-2024-0305

Indicators of Compromise

• Unauthenticated HTTP GET or POST requests to /manage/IPSetup.php from external or unexpected internal sources
• HTTP 200 responses from IPSetup.php to clients lacking a valid management session cookie
• Scanning patterns enumerating /manage/ paths on Ncast devices
• Outbound reconnaissance activity from hosts that recently accessed Ncast administrative endpoints

Detection Strategies

• Inspect web server and reverse proxy logs for requests to /manage/IPSetup.php and correlate against the source IP allowlist for administrative access
• Deploy network IDS signatures that flag access attempts to Ncast management URIs from non-management network segments
• Baseline normal administrative traffic to the device and alert on volume spikes or requests from unauthenticated sessions

Monitoring Recommendations

• Forward Ncast device and upstream proxy logs to a centralized logging platform for retention and correlation
• Monitor for sequential access to multiple /manage/ resources, which often indicates active reconnaissance
• Track external exposure of Ncast devices using attack surface management or asset inventory tooling

How to Mitigate CVE-2024-0305

Immediate Actions Required

• Restrict network access to Ncast management interfaces using firewall rules or VLAN segmentation, allowing only trusted administrative hosts
• Remove direct internet exposure of /manage/IPSetup.php and the broader /manage/ path
• Audit existing web and proxy logs for prior unauthorized access to the affected endpoint

Patch Information

No vendor patch is referenced in the NVD record for CVE-2024-0305 at the time of writing. Operators should consult Guangzhou Yingke Electronic Technology directly for fixed firmware availability. In the absence of a patch, compensating network controls are the primary mitigation. Review the VulDB advisory for additional context.

Workarounds

• Place Ncast devices behind a reverse proxy that enforces authentication before requests reach IPSetup.php
• Apply IP-based access control lists on the device or upstream network equipment to restrict the Guest Login interface
• Disable the Guest Login component if it is not required for operational use
• Decommission or isolate end-of-support Ncast devices that cannot be patched