VulnerabilityPublished 13 Jun 2024Updated 1 Aug 2024

CVE-2024-5947: Deep Sea Electronics DSE855 · Missing Authentication

Affects Deep Sea Electronics DSE855Source CVE Database V5

Not known to be exploited · public detection template (Nuclei) · CVSS 6.5 Medium.

Data as of 26 Oct 2026, 10:12 UTC

CVSS 3.0 base score

6.5Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 2.4% chance of exploitation in 30 days – higher than 84% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Adjacent
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Adjacent: The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 13 Jun 2024
Detectable: evidence found.
nuclei template: Deep Sea Electronics DSE855 - Authentication Bypass
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Deep Sea Electronics DSE855	Affected =1.1.0	Fixed in–

AI-suggested

Until an official patch is released, organizations should implement strict network segmentation to isolate DSE855 devices from untrusted networks and limit access to trusted administrators only. Employ firewall rules to restrict access to the device's web interface, allowing connections only from authorized management stations. Monitor network traffic and device logs for unusual access patterns or repeated unauthorized attempts. Change any default or weak credentials on the device and rotate credentials regularly to reduce the risk of credential compromise. If possible, disable the web-based configuration backup feature or restrict its availability. Engage with Deep Sea Electronics support channels to obtain updates on patch availability and apply them promptly once released. Additionally, consider deploying intrusion detection systems (IDS) tuned to detect reconnaissance or exploitation attempts targeting the DSE855 web interface.

Description

Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based UI. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22679.

Impact

The primary impact of CVE-2024-5947 is the unauthorized disclosure of sensitive configuration data and credentials stored within the DSE855 device. This exposure can lead to further compromise, such as unauthorized configuration changes, device control, or lateral movement within the network. Organizations relying on DSE855 controllers—commonly used in industrial control systems, power generation, and backup power management—may face increased risk of operational disruption or espionage. While the vulnerability does not directly affect device integrity or availability, the leaked credentials can facilitate more severe attacks. The lack of authentication and ease of exploitation increase the likelihood of exploitation in environments where network segmentation or access controls are weak. This could lead to breaches in critical infrastructure sectors, potentially impacting energy providers, manufacturing plants, and other industrial operations globally.

Summary

CVE-2024-5947 is a vulnerability identified in Deep Sea Electronics DSE855 controllers, version 1.1.0, classified under CWE-306 (Missing Authentication for Critical Function). The flaw resides in the device's web-based user interface, where a critical configuration backup function is exposed without any authentication requirement. This allows an attacker with network adjacency—meaning they can reach the device over the network—to access sensitive configuration data, including stored credentials. Since no authentication or user interaction is required, the attacker can directly retrieve this information, which could be leveraged to gain deeper access or control over the device or related infrastructure. The vulnerability has a CVSS 3.0 base score of 6.5, reflecting a medium severity level, with a vector indicating low attack complexity, no privileges required, and no user interaction needed. The scope is unchanged, and the impact is high on confidentiality but none on integrity or availability. No patches or mitigations have been officially released yet, and no active exploits have been reported. The vulnerability was disclosed by the Zero Day Initiative (ZDI) under the identifier ZDI-CAN-22679 and published on June 13, 2024.

CWE-306Missing Authentication for Critical Function (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #21OWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Architecture and Design
Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment.
OWASP Cheat Sheets
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V1.2.3 (opens in a new tab)
V1.2.2 (opens in a new tab)
V1.2.4 (opens in a new tab)
Attack patterns
Choosing Message Identifier (opens in a new tab)
Force the System to Reset Values (opens in a new tab)
Using Unpublished Interfaces or Functionality (opens in a new tab)
Cross Site Request Forgery (opens in a new tab)
Communication Channel Manipulation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

zerodayinitiative.com/advisories/ZDI-24-671/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Feb 2026, 02:58 UTC

Public exploits and detectiona Nuclei detection template

WeaknessesCWE-306

Technical details

References

Community reviews

Related threats