CVE-2024-28808: n/a
Source CVE Database V5
Not known to be exploited · CVSS 2.7 Low.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 29% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 30 Sep 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
Given the absence of an official patch, organizations should implement several specific mitigations: 1) Restrict administrative access to the Infinera hiT 7300 web interface strictly to trusted personnel and networks using network segmentation and access control lists (ACLs). 2) Enforce strong multi-factor authentication (MFA) for all privileged accounts to reduce the risk of credential compromise. 3) Conduct thorough audits of user privileges and remove unnecessary high-level access to minimize the attack surface. 4) Monitor web interface access logs for unusual or unauthorized attempts to access hidden or undocumented web applications. 5) Engage with Infinera support to obtain guidance on upcoming patches or workarounds and apply updates promptly once available. 6) Consider deploying intrusion detection/prevention systems (IDS/IPS) tuned to detect anomalous management interface activity. 7) Educate administrators about the risks of undocumented features and the importance of secure configuration and credential hygiene.
Description
An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authenticated attacker to access reserved information by accessing undocumented web applications.