CVE-2024-1623 is a high severity (CVSS 7.7) insufficient session timeout flaw in the Vodafone FAST3686 V2 router from Sagemcom. A local attacker could reach the administration panel without logging in. The record does not name a fixed firmware version, so check with your provider.
What's affected
The NVD record names the Sagemcom F@ST 3686 V2 router and its firmware as affected. It says the Login.asp and logout.asp files do not handle session details correctly. The record does not list a fixed firmware version, and the reference is a notice from INCIBE-CERT, the Spanish national CERT. We could not read the notice text when we fetched it, so treat the exact firmware range as unconfirmed and check the notice directly.
The score is 7.7 (high) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N in the NVD data. The weakness is CWE-613 (insufficient session expiration).
How to check if you're exposed
Consumer and ISP routers are managed by the provider, so the first step is to find out who controls firmware.
- Identify the model and firmware version on the router label or admin page.
- Ask your provider whether a fixed firmware has been pushed, and request the version number.
- Read the INCIBE-CERT notice for the vendor's guidance.
If the router sits in an office or shared space, consider who can reach the admin interface from the local network.
What to do now
- Confirm whether you have a Sagemcom FAST3686 V2 device.
- Contact the provider for the patched firmware status and install it when offered.
- Restrict access to the router's admin interface to trusted devices only.
- Sign out of the admin panel after use and do not leave sessions open on shared computers.
- Change the admin password if you suspect someone on the network has had access.
Why it matters
An admin page that does not end or protect a session properly can be reused by someone who did not log in. The class is CWE-613 (insufficient session expiration): a session stays valid when it should have ended, or session handling fails to bind access to the person who signed in.
Routers sit at the edge of a network, so control of the admin panel can mean control of traffic settings. The record says nothing about exploitation, and it is not in the CISA Known Exploited Vulnerabilities catalog. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
Is a fix available?
The record does not state a fixed firmware version. Ask your provider and read the INCIBE-CERT notice for current guidance.
Sources
Last reviewed: 19 October 2026.
