CVE-2024-58337 HIGH

CVE-2024-58337: Akuvox Smart Intercom S539 Improper Access Control via ServicesHTTPAPI

Vendor The Akuvox Company
Product Akuvox Smart Doorphone
Weakness CWE-862 · Missing authorization
Published December 30, 2025
Last update January 16, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations. Attackers can exploit this vulnerability to escalate privileges and gain unauthorized access to administrative functionalities.

Key dates

02Disclosure timeline

December 30, 2025 CVE published
January 16, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-24994 WordPress Sunshine Photo Cart plugin <= 3.5.7.2 - Broken Access Control vulnerability CVE-2024-33563 WordPress XStore theme <= 9.3.8 - Broken Access Control vulnerability CVE-2025-29756 MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters CVE-2026-24588 WordPress Smart Product Viewer plugin <= 1.5.4 - Broken Access Control vulnerability CVE-2024-27970 WordPress WP SendFox plugin <= 1.3.0 - Broken Access Control vulnerability