CVE-2024-6921 describes a vulnerability in NACPremium where sensitive information is stored in cleartext, enabling unauthorized retrieval of embedded sensitive data. The vulnerability has a CVSS 4.0 base score of 8.7, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not yet provided an official fix or remediation guidance. This vulnerability affects NACPremium versions through 01082024 and is categorized under CWE-312 (Cleartext Storage of Sensitive Information).

An attacker with low privileges can remotely retrieve sensitive information stored in cleartext within the NACPremium product. This exposure can lead to significant confidentiality, integrity, and availability impacts as indicated by the CVSS vector. No known exploits are currently reported in the wild, but the vulnerability poses a high risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to affected NACPremium systems to trusted users only and monitor for any unusual access patterns to sensitive data. Avoid storing sensitive information in cleartext where possible and apply compensating controls such as encryption or access controls if feasible.