PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-38283 Motorola Solutions CVE debrief

Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) devices store sensitive customer information without encryption, exposing data to physical-access attackers. The vulnerability affects firmware version 3.1.171.9 and earlier. CISA published advisory ICSA-24-165-19 on June 13, 2024, with a CVSS 3.1 score of 4.6 (MEDIUM). Motorola Solutions has already remediated this vulnerability for all affected systems; no customer action is required.

Vendor
Motorola Solutions
Product
Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
CVSS
MEDIUM 4.6
CISA KEV
Not listed in stored evidence
Original CVE published
2024-06-13
Original CVE updated
2024-06-13
Advisory published
2024-06-13
Advisory updated
2024-06-13

Who should care

Organizations operating Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) license plate reader systems, particularly in law enforcement, parking enforcement, and critical infrastructure security applications where license plate data confidentiality is required.

Technical summary

The Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) stores sensitive customer information without encryption. An attacker with physical access to the device can extract this unencrypted data. The vulnerability is rated CVSS 3.1 4.6 (MEDIUM) with attack vector PHYSICAL, low attack complexity, and high confidentiality impact. Affected versions are firmware 3.1.171.9 and earlier. Motorola Solutions has already remediated this vulnerability across all affected systems; no customer action is required.

Defensive priority

medium

Recommended defensive actions

  • Verify that affected Motorola Solutions Vigilant Fixed LPR Coms Box devices are running firmware newer than version 3.1.171.9
  • Contact Motorola Solutions support if device firmware version cannot be confirmed or if remediation status is uncertain
  • Review device physical security controls to prevent unauthorized local access
  • Monitor CISA ICS advisories for related security updates

Evidence notes

CISA advisory ICSA-24-165-19 confirms the vulnerability affects Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) firmware version 3.1.171.9 and earlier. The advisory states that sensitive customer information is stored in the device without encryption. Motorola Solutions reports that remediation has already been applied to all vulnerable systems.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-38283 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-38283

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-38283 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-38283

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-165-19.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.