CVE-2024-21865 - Vulnerability Details - OpenCVE

HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00033.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-19476	HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://jvn.jp/en/vu/JVNVU93546510/
https://kddi-tech.com/contents/appendix_L2_06.html#20304f4c-af1b-49fd-c3b5-8d1f55fd8b4f
https://www.au.com/support/service/internet/guide/modem/bl1500hm/firmware/

History

Fri, 19 Sep 2025 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-521

Fri, 28 Mar 2025 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1391
References		https://kddi-tech.com/contents/appendix_L2_06.html#20304f4c-af1b-49fd-c3b5-8d1f55fd8b4f

Sun, 27 Oct 2024 03:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-521
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-03-25T04:11:34.280Z

Updated: 2025-09-19T17:22:54.820Z

Reserved: 2024-03-18T01:23:32.331Z

Link: CVE-2024-21865

Vulnrichment

Updated: 2024-08-01T22:27:36.343Z

NVD

Status : Awaiting Analysis

Published: 2024-03-25T05:15:50.863

Modified: 2025-09-19T18:15:35.387

Link: CVE-2024-21865

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21865", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-03-18T01:23:32.331Z", "datePublished": "2024-03-25T04:11:34.280Z", "dateUpdated": "2025-09-19T17:22:54.820Z"}, "containers": {"cna": {"affected": [{"vendor": "KDDI CORPORATION", "product": "HGW BL1500HM", "versions": [{"version": "Ver 002.001.013 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell."}], "problemTypes": [{"descriptions": [{"description": "Use of weak credentials", "lang": "en-US", "cweId": "CWE-1391", "type": "CWE"}]}], "references": [{"url": "https://kddi-tech.com/contents/appendix_L2_06.html#20304f4c-af1b-49fd-c3b5-8d1f55fd8b4f"}, {"url": "https://jvn.jp/en/vu/JVNVU93546510/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-03-28T07:38:26.719Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-17T15:29:40.852705Z", "id": "CVE-2024-21865", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-19T17:22:54.820Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:27:36.343Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.au.com/support/service/internet/guide/modem/bl1500hm/firmware/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/vu/JVNVU93546510/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.au.com/support/service/internet/guide/modem/bl1500hm/firmware/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/vu/JVNVU93546510/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:27:36.343Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-21865", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-17T15:29:40.852705Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-17T15:29:46.986Z"}}], "cna": {"affected": [{"vendor": "KDDI CORPORATION", "product": "HGW BL1500HM", "versions": [{"status": "affected", "version": "Ver 002.001.013 and earlier"}]}], "references": [{"url": "https://kddi-tech.com/contents/appendix_L2_06.html#20304f4c-af1b-49fd-c3b5-8d1f55fd8b4f"}, {"url": "https://jvn.jp/en/vu/JVNVU93546510/"}], "descriptions": [{"lang": "en", "value": "HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-1391", "description": "Use of weak credentials"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-03-28T07:38:26.719Z"}}}, "cveMetadata": {"cveId": "CVE-2024-21865", "state": "PUBLISHED", "dateUpdated": "2025-09-19T17:22:54.820Z", "dateReserved": "2024-03-18T01:23:32.331Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-03-25T04:11:34.280Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}