PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-38284 Motorola Solutions CVE debrief

Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) devices running firmware version 3.1.171.9 and earlier logged transmitted data between the device and backend service. An attacker with access to these logs could perform replay attacks to replicate authenticated calls. This vulnerability was assigned CVSS 3.1 score 8.8 (HIGH severity). Motorola Solutions has already remediated this vulnerability for all affected systems; no customer action is required. The vulnerability was published by CISA on June 13, 2024.

Vendor
Motorola Solutions
Product
Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-06-13
Original CVE updated
2024-06-13
Advisory published
2024-06-13
Advisory updated
2024-06-13

Who should care

Organizations operating Motorola Solutions Vigilant license plate reader systems, critical infrastructure security teams, law enforcement technology administrators, and OT/ICS security practitioners responsible for physical security system integrations.

Technical summary

The Vigilant Fixed LPR Coms Box (BCAV1F2-C600) firmware version 3.1.171.9 and earlier logged transmitted data between the device and backend service. This logging included credentialed web requests, enabling an attacker with log access to capture and replay authenticated calls to the backend service. The vulnerability requires network access and low privileges to obtain logs. Motorola Solutions has remediated this by deploying updated software that does not log credentialed web requests and has completed remediation across all affected systems without requiring customer action.

Defensive priority

HIGH

Recommended defensive actions

  • Verify no local log files remain on any Vigilant Fixed LPR Coms Box devices running firmware <=3.1.171.9
  • Confirm devices have received vendor remediation (updated software not logging credentialed web requests)
  • Review network segmentation between license plate reader devices and backend services
  • Apply CISA ICS recommended practices for defense-in-depth strategies
  • Monitor for anomalous backend service calls that may indicate replay attack attempts

Evidence notes

CISA advisory ICSA-24-165-19 confirms the affected product as Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) version <=3.1.171.9. The advisory states transmitted data logging between device and backend service enables replay attacks. Remediation was completed by the vendor without requiring customer action.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-38284 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-38284

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-38284 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-38284

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-165-19.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-19

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.