CVE-2024-1662: Porty PowerBank Auth Bypass Vulnerability

CVE-2024-1662 Overview

CVE-2024-1662 is a missing authentication and missing authorization vulnerability in the PORTY Smart Tech Technology Joint Stock Company PowerBank Application. The flaw allows unauthenticated network attackers to retrieve embedded sensitive data from the application. The vulnerability affects all versions of the PowerBank Application prior to 2.02.

The issue is tracked under CWE-306: Missing Authentication for Critical Function. It exposes confidential data without requiring user interaction or prior privileges.

Critical Impact

Remote attackers can extract sensitive embedded data from the PowerBank Application without authentication, leading to confidentiality loss for application users and operators.

Affected Products

• PORTY PowerBank Application versions before 2.02
• Vendor: PORTY Smart Tech Technology Joint Stock Company
• Component: porty:powerbank

Discovery Timeline

• 2024-06-05 - CVE-2024-1662 published to the National Vulnerability Database (NVD)
• 2025-10-14 - Last updated in NVD database

Technical Details for CVE-2024-1662

Vulnerability Analysis

The PowerBank Application exposes a critical function over the network without enforcing authentication or authorization checks. An attacker reaching the application interface can invoke sensitive operations and retrieve embedded data that should be restricted to authenticated principals.

Because the attack vector is network-based with low complexity and no privileges required, exploitation can be automated against any reachable instance. The Exploit Prediction Scoring System (EPSS) reports a probability of 0.2% with a percentile of 41.81, indicating limited observed exploitation activity in the wild.

Root Cause

The root cause is the absence of authentication controls on a function that handles sensitive embedded data, classified under CWE-306. The application does not verify the identity of the caller before returning protected content. A secondary authorization gap means even identity-aware logic does not enforce access boundaries on the resource.

Attack Vector

Exploitation requires network access to the PowerBank Application endpoint. An attacker issues requests to the affected function and receives sensitive embedded data in the response. No user interaction, social engineering, or pre-existing credentials are needed. The vulnerability impacts confidentiality only; integrity and availability are not directly affected per the CVSS vector.

No public proof-of-concept exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are referenced in the USOM Security Advisory TR-24-0602.

Detection Methods for CVE-2024-1662

Indicators of Compromise

• Unauthenticated HTTP or API requests to PowerBank Application endpoints originating from external networks
• Anomalous outbound responses from the application containing structured sensitive data fields
• Repeated requests to the same critical function endpoint from a single IP address without prior authentication traffic

Detection Strategies

• Inspect web server and application logs for requests to sensitive endpoints that lack an associated authenticated session or token
• Deploy network monitoring rules that flag access to PowerBank Application APIs from untrusted source ranges
• Correlate request patterns with response size anomalies that suggest bulk data retrieval

Monitoring Recommendations

• Enable verbose access logging on the PowerBank Application and forward logs to a centralized SIEM for retention and analysis
• Establish a baseline of normal API call patterns and alert on deviations indicating enumeration or scraping
• Monitor application version banners to confirm that all deployed instances run version 2.02 or later

How to Mitigate CVE-2024-1662

Immediate Actions Required

• Upgrade the PORTY PowerBank Application to version 2.02 or later on all deployed instances
• Restrict network exposure of the application to trusted segments using firewall rules or network access control lists
• Audit application logs for evidence of unauthenticated access to sensitive functions prior to patching

Patch Information

The vendor has resolved the issue in PowerBank Application version 2.02. Operators should consult the USOM Security Advisory TR-24-0602 for upgrade guidance and coordinate with the vendor for deployment in production environments.

Workarounds

• Place the application behind an authenticating reverse proxy that enforces identity verification before requests reach the vulnerable endpoint
• Apply IP allowlisting at the network edge to limit access to known administrative hosts until the upgrade is completed
• Rotate any credentials, tokens, or keys that may have been embedded in the application data exposed by the vulnerability

# Example: restrict access to the PowerBank Application port using iptables
iptables -A INPUT -p tcp --dport <app_port> -s <trusted_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <app_port> -j DROP