Medium severity · published Nov 20, 2024
CVE-2024-52033
Exposure of sensitive system information to an unauthorized control sphere issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Exposure of sensitive system information to an unauthorized control sphere issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote unauthenticated attacker may obtain information of the other devices connected through the Wi-Fi.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RT
Rakuten Turbo 5G · Rakuten Mobile, Inc.
V1.3.18 and earlier · source: vendor
T5
Turbo 5g Firmware · Rakuten
through 1.3.18 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52033
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52033
jvn.jp
https://jvn.jp/en/vu/JVNVU90667116/
network.mobile.rakuten.co.jp
https://network.mobile.rakuten.co.jp/internet/turbo/information/news/3184/
More from Rakuten Turbo 5G
8.8
CVE-2024-48895
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier
5.3
CVE-2024-47865
Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier