Critical severity · published Jun 11, 2024
CVE-2024-2012
vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server…
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or
code to be executed on the UNEM server allowing sensitive data to
be read or modified or could cause other unintended behavior
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Foxman-un · Hitachienergy
r15a; r15b; r16a; r16b · source: NVD
UN
Unem · Hitachienergy
r15a; r15b; r15b; r16a; r16b · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2012
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2012
Vendor Advisory
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true
More from Foxman-un
10.0
CVE-2024-2013
An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the…
9.8
CVE-2024-2011
A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but can be used to execute arbitrary code,…
9.8
CVE-2022-3929
Communication between the client and the server application of the affected products is partially done using CORBA (Common Object Request Broker Architecture) over TCP/IP
9.8
CVE-2022-3927
The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification
9.8
CVE-2021-40342
In the DES implementation, the affected product versions use a default key for encryption