Critical severity · published Jun 11, 2024
CVE-2024-2012
vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server…
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or
code to be executed on the UNEM server allowing sensitive data to
be read or modified or could cause other unintended behavior
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
FOXMAN-UN · Hitachi Energy
FOXMAN-UN R16B PC2; FOXMAN-UN R15B PC4; FOXMAN-UN R16A; FOXMAN-UN R15A · source: vendor, NVD
UN
UNEM · Hitachi Energy
UNEM R16B PC2; UNEM R15B PC4; UNEM R15B PC5; UNEM R15A; UNEM R16A · source: vendor, NVD, CISA
FU
Foxman UN · Hitachienergy
pc2; pc4; r16a; r15a · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2012
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2012
Vendor Advisory
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true
More from FOXMAN-UN
10.0
CVE-2024-2013
An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the…
9.8
CVE-2024-2011
A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but can be used to execute arbitrary code,…
8.0
CVE-2024-28020
A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management
7.4
CVE-2024-28021
A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation
6.8
CVE-2024-2462
Allow attackers to intercept or falsify data exchanges between the client and the server