CVE-2024-40091 describes a vulnerability in the Vilo 5 Mesh WiFi System (versions <= 5.16.1.33) where the embedded Boa webserver does not enforce authentication. This allows remote attackers without any privileges to access and retrieve system logs that may contain sensitive system information. The vulnerability is identified as CWE-306, indicating missing authentication controls on critical functionality. The CVSS 3.1 base score is 5.3, reflecting a medium severity with attack vector as adjacent network, high attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

Remote unauthenticated attackers can access sensitive system logs via the Boa webserver on affected Vilo 5 Mesh WiFi System devices. This exposure can lead to information disclosure, potentially aiding further attacks or reconnaissance. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting network access to the Boa webserver interface and disabling remote management features where possible may reduce exposure.