PatchTheCVECVE-2024-2413: Intumit SmartRobot uses a fixed encryption key for authentication
CVE-2024-2413 is a critical-severity flaw (CVSS 9.8) affecting smartrobot. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timestamp to generate an authentication code. With this authentication code, they can obtain administrator privileges and subsequently execute arbitrary code on the remote server using built-in system functionality.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 53%) |
| CISA exploited list | No |
| Weakness | CWE-321 |
| Published | 2024-03-13 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-2413?
smartrobot: upgrade to 6.2.0-202303TW. Exact commands for each OS are on this page.
Is CVE-2024-2413 being exploited?
CVE-2024-2413 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-2413 affect?
CVE-2024-2413 affects smartrobot. Severity is critical (CVSS 9.8). Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timestamp to generate an authentication code. With this authentication code, they can o
How urgent is CVE-2024-2413?
Priority 51/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-3572 HIGH 7.5 UPGRADE SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attac
- CVE-2024-8776 MEDIUM 6.1 UPGRADE SmartRobot from INTUMIT does not properly validate a specific page parameter, allowing unautheticated remote a
- CVE-2024-12652 HIGH 8.8 UPGRADE A Improper Control of Generation of Code ('Code Injection') vulnerability in groovy script function in SmartRo
- CVE-2024-0552 CRITICAL 9.8 UPGRADE Intumit inc