CVE-2024-36391: Milesight DeviceHub Auth Bypass Flaw

CVE-2024-36391 Overview

CVE-2024-36391 affects MileSight DeviceHub, an Internet of Things (IoT) device management platform. The vulnerability stems from key management errors classified under [CWE-320]. Improper handling of cryptographic keys allows attackers to bypass authentication and conduct man-in-the-middle (MITM) attacks against device communications. The flaw was published to the National Vulnerability Database (NVD) on June 2, 2024, and last updated on March 4, 2025.

Critical Impact
Attackers on the network can intercept, decrypt, or manipulate device traffic and bypass authentication controls protecting MileSight DeviceHub deployments.

Affected Products

MileSight DeviceHub version 3.0.1-r1
Canonical Ubuntu Linux 20.04 (underlying platform)
IoT deployments relying on DeviceHub for device management

Discovery Timeline

2024-06-02 - CVE-2024-36391 published to NVD
2025-03-04 - Last updated in NVD database

Technical Details for CVE-2024-36391

Vulnerability Analysis

The vulnerability resides in how MileSight DeviceHub manages cryptographic keys used to authenticate communications between the management platform and managed IoT devices. Under [CWE-320: Key Management Errors], the product fails to generate, distribute, or protect cryptographic keys according to secure design principles. This weakness undermines the integrity guarantees of the transport layer and the authentication mechanism.

An attacker with network access can leverage these errors to impersonate either side of the communication channel. Successful exploitation results in authentication bypass and the ability to intercept or modify traffic in transit. The attack does not require privileges or user interaction, although the attack complexity is elevated due to required network positioning and timing.

Root Cause

The root cause is improper key management in the DeviceHub platform. Reused, predictable, or insufficiently protected cryptographic material allows an adversary to derive or substitute keys used during authentication. When the platform validates a peer using compromised key material, the trust relationship between DeviceHub and managed devices collapses.

Attack Vector

Exploitation occurs over the network. An attacker positioned between DeviceHub and its managed endpoints intercepts protocol exchanges and uses knowledge of the flawed key handling to negotiate or impersonate a trusted session. From that position, the attacker can read confidential telemetry, inject management commands, or alter configuration data. No verified public exploit or proof-of-concept code is available for CVE-2024-36391. See the Israeli Government CVE Advisories for additional technical context.

Detection Methods for CVE-2024-36391

Indicators of Compromise

Unexpected TLS session renegotiations or certificate mismatches between DeviceHub and managed devices
Device management commands originating from IP addresses outside the documented administrative range
Authentication events for DeviceHub sessions without corresponding administrator activity in audit logs
Anomalous configuration changes pushed to IoT endpoints during off-hours

Detection Strategies

Inspect network traffic between DeviceHub and managed devices for protocol anomalies and abnormal handshake patterns
Compare cryptographic certificates and keys presented by DeviceHub against a known-good baseline
Correlate device telemetry deviations with administrative actions to identify injected commands
Enable verbose audit logging on the DeviceHub server and forward events to a centralized log platform

Monitoring Recommendations

Deploy network sensors on management VLANs to capture DeviceHub-to-device flows for analysis
Alert on new ARP or routing entries that could indicate adjacent attackers staging a MITM position
Track authentication success rates and flag deviations from established baselines
Monitor the Ubuntu 20.04 host running DeviceHub for unauthorized process and configuration changes

How to Mitigate CVE-2024-36391

Immediate Actions Required

Isolate MileSight DeviceHub 3.0.1-r1 instances on a dedicated management network segment with strict access controls
Restrict inbound and outbound traffic to DeviceHub to known administrative hosts and managed device IP ranges
Rotate any cryptographic material, API tokens, and administrative credentials associated with DeviceHub
Review device management audit logs for unauthorized commands or configuration changes since deployment

Patch Information

No vendor patch URL is published in the available CVE references at this time. Operators should contact MileSight directly for the latest firmware and DeviceHub updates addressing CVE-2024-36391. Monitor the Israeli Government CVE Advisories for additional remediation guidance.

Workarounds

Place DeviceHub behind a VPN or zero-trust network access gateway to eliminate exposure to untrusted networks
Enforce mutual TLS with externally managed certificates where the platform supports custom certificate configuration
Disable remote administrative access from untrusted networks until a vendor-supplied fix is applied
Apply network segmentation between the DeviceHub host and general-purpose corporate networks

bash

# Configuration example: restrict DeviceHub access via iptables on Ubuntu 20.04
sudo iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j DROP
sudo iptables-save | sudo tee /etc/iptables/rules.v4