CVE-2024-0712 is a high severity flaw in Byzoro Smart S150 Management Platform V31R02B15, scored 7.3 by NVD. No fixed version is confirmed in the sources I could check, so limit who can reach it, watch for a vendor release, and plan an upgrade or replacement.
What's affected
The record lists Byzoro Smart S150 Management Platform V31R02B15 as affected. The record says an unknown function of /useratte/inc/userattea.php leads to improper access control and that the attack can be launched remotely. It notes the vendor was contacted early and did not respond. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The weakness is CWE-284.
The record's description is short and does not name a fixed release. The linked pages are public write-ups of the issue, not a vendor patch notice.
How to check if you're exposed
Check whether the management platform answers on a public address. Run your usual external port scan or look at your firewall rules for the host. Read the firmware version in the admin interface and compare it with V31R02B15.
If the product reached you inside another package, run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests to see whether it appears. For standalone software, the inventory is the check: find where it is installed, which version it is, and whether the service is reachable from outside the machine.
What to do now
- Find every installation of the product and note its version.
- Check the vendor site and project repository for a newer release, and read its notes before upgrading. Do not assume a later version is fixed without a statement that says so.
- Restrict network access to the service with firewall rules so only trusted hosts can reach it.
- Watch logs for repeated odd requests or unexpected crashes aimed at the affected component.
- If the software looks unmaintained, plan to replace it, and record the risk decision in the meantime.
Why it matters
Improper access control means a function can be reached without the checks that should stand in front of it. The record's vector needs no privileges and no user interaction, and rates impact as low across confidentiality, integrity and availability. It lands at a high rating because it is network reachable with low complexity.
The product is a management platform. Management interfaces are worth protecting more than the score implies, because they often touch user accounts and configuration for other systems. The usual defences are to keep them off the internet, put them behind a VPN or allowlist, and apply vendor updates when they exist. Here the vendor did not respond, so network controls are the main lever.
The record notes that an exploit has been disclosed publicly. That is not the same as confirmed attacks, and the record does not flag this CVE in the CISA Known Exploited Vulnerabilities list. Public detail still lowers the effort for someone to try it, which is a reason to reduce exposure early.
Quick check
Is there a vendor fix?
None is confirmed. The record says the vendor did not respond.
Why high if impact is low?
The score is driven by easy network access with no privileges. The impact metrics are each low.
Sources
Last reviewed: 19 October 2026.
