CVE-2024-40617 - Vulnerability Details - OpenCVE

Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). If a remote authenticated attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result, Administrator Class privileges of the product may be hijacked.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.13247.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Fujitsu	Network Edgiot Gw1500 Network Edgiot Gw1500 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:fujitsu:network_edgiot_gw1500_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:fujitsu:network_edgiot_gw1500:-:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://fenics.fujitsu.com/networkservice/m2m/download/update-m.html
https://jvn.jp/en/jp/JVN25583987/

History

Tue, 10 Sep 2024 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fujitsu Fujitsu network Edgiot Gw1500 Fujitsu network Edgiot Gw1500 Firmware
Weaknesses		CWE-22
CPEs		cpe:2.3:h:fujitsu:network_edgiot_gw1500:-:::::::* cpe:2.3:o:fujitsu:network_edgiot_gw1500_firmware::::::::
Vendors & Products		Fujitsu Fujitsu network Edgiot Gw1500 Fujitsu network Edgiot Gw1500 Firmware
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-07-17T08:44:44.939Z

Updated: 2024-10-29T20:04:48.758Z

Reserved: 2024-07-08T00:59:01.182Z

Link: CVE-2024-40617

Vulnrichment

Updated: 2024-08-02T04:33:12.034Z

NVD

Status : Modified

Published: 2024-07-17T09:15:03.163

Modified: 2024-11-21T09:31:22.627

Link: CVE-2024-40617

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40617", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-07-08T00:59:01.182Z", "datePublished": "2024-07-17T08:44:44.939Z", "dateUpdated": "2024-10-29T20:04:48.758Z"}, "containers": {"cna": {"affected": [{"vendor": "Fujitsu Limited", "product": "FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS)", "versions": [{"version": "prior to V02L19C01", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). If a remote authenticated attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result, Administrator Class privileges of the product may be hijacked."}], "problemTypes": [{"descriptions": [{"description": "Path traversal", "lang": "en", "type": "text"}]}], "references": [{"url": "https://fenics.fujitsu.com/networkservice/m2m/download/update-m.html"}, {"url": "https://jvn.jp/en/jp/JVN25583987/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-07-17T08:44:44.939Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-23T13:18:04.112623Z", "id": "CVE-2024-40617", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T20:04:48.758Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:33:12.034Z"}, "title": "CVE Program Container", "references": [{"url": "https://fenics.fujitsu.com/networkservice/m2m/download/update-m.html", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN25583987/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://fenics.fujitsu.com/networkservice/m2m/download/update-m.html", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN25583987/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:33:12.034Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-40617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-23T13:18:04.112623Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-25T15:57:02.605Z"}}], "cna": {"affected": [{"vendor": "Fujitsu Limited", "product": "FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS)", "versions": [{"status": "affected", "version": "prior to V02L19C01"}]}], "references": [{"url": "https://fenics.fujitsu.com/networkservice/m2m/download/update-m.html"}, {"url": "https://jvn.jp/en/jp/JVN25583987/"}], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). If a remote authenticated attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result, Administrator Class privileges of the product may be hijacked."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Path traversal"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-07-17T08:44:44.939Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40617", "state": "PUBLISHED", "dateUpdated": "2024-10-29T20:04:48.758Z", "dateReserved": "2024-07-08T00:59:01.182Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-07-17T08:44:44.939Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:network_edgiot_gw1500_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6ACFC28A-5D75-49D5-B4B5-D72695A7567F", "versionEndExcluding": "v02l19c01", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:network_edgiot_gw1500:-:*:*:*:*:*:*:*", "matchCriteriaId": "6402659A-E18E-4B42-823B-F6D5181D505E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). If a remote authenticated attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result, Administrator Class privileges of the product may be hijacked."}, {"lang": "es", "value": "Existe una vulnerabilidad de path traversal en FUJITSU Network Edgiot GW1500 (M2M-GW para FENICS). Si un atacante remoto autenticado con privilegios de clase de usuario env\u00eda una solicitud especialmente manipulada al producto afectado, se puede acceder a archivos restringidos que contienen informaci\u00f3n confidencial. Como resultado, se pueden secuestrar los privilegios de clase de administrador del producto."}], "id": "CVE-2024-40617", "lastModified": "2024-11-21T09:31:22.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-07-17T09:15:03.163", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Permissions Required"], "url": "https://fenics.fujitsu.com/networkservice/m2m/download/update-m.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN25583987/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://fenics.fujitsu.com/networkservice/m2m/download/update-m.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN25583987/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}