High severity · published Apr 30, 2024
CVE-2024-2377
A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600
7.6
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
SDM600 · Hitachi Energy
before 1.3.4 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2377
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2377
publisher.hitachienergy.com
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000191&languageCode=en&Preview=true
More from SDM600
9.1
CVE-2022-3686
SDM600 API permission check
8.8
CVE-2022-3682
SDM600 file permission validation
8.0
CVE-2024-2378
A vulnerability exists in the web-authentication component of the SDM600
7.5
CVE-2022-3684
SDM600 endpoint vulnerability
7.5
CVE-2022-3683
SDM600 API web services authorization validation