“the honest truth is I found a vulnerability in the webapp in the first 15 minutes of having the unit online and it was the first thing I tried.”
The Intelight X-1 traffic controller shipped with no web authentication, and its settings page showed the default credentials in clear text. Past the login, an attacker can stretch a phase, upload a configuration or throw an intersection into four-way flash. Q-Free’s answer to the report was a letter from its General Counsel calling the product end of life and the finding invalid. The vendor sent lawyers instead of a patch. CVE-2024-38944 exists anyway.