CVE-2024-47044 - Vulnerability Details - OpenCVE

Description

Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for Device Setting pages. If this vulnerability is exploited, an attacker who identified WAN-side IPv6 address may access the product's Device Setting page via WAN-side. Note that, the same products are also provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION, but the vulnerability only affects products subscribed and used in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION areas.

Published: 2024-09-26

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION

Hikari Denwa router RT-400MI

affected

Version	Status	Constraints
`Ver.09.00.0015 and earlier`	affected	—

NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION

Hikari Denwa router PR-400MI

affected

Version	Status	Constraints
`Ver.09.00.0015 and earlier`	affected	—

NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION

Hikari Denwa router RV-440MI

affected

Version	Status	Constraints
`Ver.09.00.0015 and earlier`	affected	—

NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION

Home GateWay/Hikari Denwa router PR-500MI/RS-500MI/RT-500MI

affected

Version	Status	Constraints
`Ver.08.00.0004 and earlier`	affected	—

NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION

Home GateWay/Hikari Denwa router PR-600MI/RX-600MI

affected

Version	Status	Constraints
`Ver.01.00.0008 and earlier`	affected	—

No data.

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00296.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://jvn.jp/en/jp/JVN78356367/
https://web116.jp/ced/support/news/contents/2024/20240930.html
https://web116.jp/ced/support/version/broadband/500mi/
https://web116.jp/ced/support/version/broadband/600mi/
https://web116.jp/ced/support/version/broadband/pr_400mi/
https://web116.jp/ced/support/version/broadband/rt_400mi/
https://web116.jp/ced/support/version/broadband/rv_440mi/

History

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00226}`	epss `{'score': 0.00245}`

Thu, 17 Oct 2024 01:45:00 +0000

Type	Values Removed	Values Added
References		https://web116.jp/ced/support/news/contents/2024/20240930.html

Thu, 26 Sep 2024 19:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ntt-east Ntt-east pr-400mi Firmware Ntt-east pr-500mi Firmware Ntt-east pr-600mi Firmware Ntt-east rs-500mi Firmware Ntt-east rt-400mi Firmware Ntt-east rt-500mi Firmware Ntt-east rv-440mi Firmware Ntt-east rx-600mi Firmware
CPEs		cpe:2.3:o:ntt-east:pr-400mi_firmware:-:::::::* cpe:2.3:o:ntt-east:pr-500mi_firmware:-:::::::* cpe:2.3:o:ntt-east:pr-600mi_firmware:::::::: cpe:2.3:o:ntt-east:rs-500mi_firmware:-:::::::* cpe:2.3:o:ntt-east:rt-400mi_firmware:-:::::::* cpe:2.3:o:ntt-east:rt-500mi_firmware:-:::::::* cpe:2.3:o:ntt-east:rv-440mi_firmware:-:::::::* cpe:2.3:o:ntt-east:rx-600mi_firmware::::::::
Vendors & Products		Ntt-east Ntt-east pr-400mi Firmware Ntt-east pr-500mi Firmware Ntt-east pr-600mi Firmware Ntt-east rs-500mi Firmware Ntt-east rt-400mi Firmware Ntt-east rt-500mi Firmware Ntt-east rv-440mi Firmware Ntt-east rx-600mi Firmware
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 26 Sep 2024 08:45:00 +0000

Type	Values Removed	Values Added
Description		Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for Device Setting pages. If this vulnerability is exploited, an attacker who identified WAN-side IPv6 address may access the product's Device Setting page via WAN-side. Note that, the same products are also provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION, but the vulnerability only affects products subscribed and used in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION areas.
Weaknesses		CWE-451
References		https://jvn.jp/en/jp/JVN78356367/ https://web116.jp/ced/support/version/broadband/500mi/ https://web116.jp/ced/support/version/broadband/600mi/ https://web116.jp/ced/support/version/broadband/pr_400mi/ https://web116.jp/ced/support/version/broadband/rt_400mi/ https://web116.jp/ced/support/version/broadband/rv_440mi/

Subscriptions

Ntt-east Pr-400mi Firmware Pr-500mi Firmware Pr-600mi Firmware Rs-500mi Firmware Rt-400mi Firmware Rt-500mi Firmware Rv-440mi Firmware Rx-600mi Firmware

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-09-26T08:34:30.347Z

Updated: 2024-10-17T01:33:49.083Z

Reserved: 2024-09-17T04:53:47.412Z

Link: CVE-2024-47044

Vulnrichment

Updated: 2024-09-26T18:33:10.450Z

NVD

Status : Awaiting Analysis

Published: 2024-09-26T09:15:02.317

Modified: 2024-10-17T02:15:02.840

Link: CVE-2024-47044

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-451

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47044", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-09-17T04:53:47.412Z", "datePublished": "2024-09-26T08:34:30.347Z", "dateUpdated": "2024-10-17T01:33:49.083Z"}, "containers": {"cna": {"affected": [{"vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION", "product": "Hikari Denwa router RT-400MI", "versions": [{"version": "Ver.09.00.0015 and earlier", "status": "affected"}]}, {"vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION", "product": "Hikari Denwa router PR-400MI", "versions": [{"version": "Ver.09.00.0015 and earlier", "status": "affected"}]}, {"vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION", "product": "Hikari Denwa router RV-440MI", "versions": [{"version": "Ver.09.00.0015 and earlier", "status": "affected"}]}, {"vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION", "product": "Home GateWay/Hikari Denwa router PR-500MI/RS-500MI/RT-500MI", "versions": [{"version": "Ver.08.00.0004 and earlier", "status": "affected"}]}, {"vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION", "product": "Home GateWay/Hikari Denwa router PR-600MI/RX-600MI", "versions": [{"version": "Ver.01.00.0008 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for Device Setting pages. If this vulnerability is exploited, an attacker who identified WAN-side IPv6 address may access the product's Device Setting page via WAN-side. Note that, the same products are also provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION, but the vulnerability only affects products subscribed and used in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION areas."}], "problemTypes": [{"descriptions": [{"description": "User interface (UI) misrepresentation of critical information", "lang": "en-US", "cweId": "CWE-451", "type": "CWE"}]}], "references": [{"url": "https://web116.jp/ced/support/news/contents/2024/20240930.html"}, {"url": "https://web116.jp/ced/support/version/broadband/rt_400mi/"}, {"url": "https://web116.jp/ced/support/version/broadband/pr_400mi/"}, {"url": "https://web116.jp/ced/support/version/broadband/rv_440mi/"}, {"url": "https://web116.jp/ced/support/version/broadband/500mi/"}, {"url": "https://web116.jp/ced/support/version/broadband/600mi/"}, {"url": "https://jvn.jp/en/jp/JVN78356367/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-10-17T01:33:49.083Z"}}, "adp": [{"affected": [{"vendor": "ntt-east", "product": "rv-440mi_firmware", "cpes": ["cpe:2.3:o:ntt-east:pr-400mi_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:ntt-east:rt-400mi_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:ntt-east:rv-440mi_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "09.00.0015", "versionType": "custom"}]}, {"vendor": "ntt-east", "product": "rt-500mi_firmware", "cpes": ["cpe:2.3:o:ntt-east:pr-500mi_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:ntt-east:rs-500mi_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:ntt-east:rt-500mi_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "08.00.0004", "versionType": "custom"}]}, {"vendor": "ntt-east", "product": "rx-600mi_firmware", "cpes": ["cpe:2.3:o:ntt-east:pr-600mi_firmware:*:*:*:*:*:*:*:*", "cpe:2.3:o:ntt-east:rx-600mi_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "01.00.0008", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-26T18:32:49.475278Z", "id": "CVE-2024-47044", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-26T18:42:16.913Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-47044", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-26T18:32:49.475278Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:ntt-east:pr-400mi_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:ntt-east:rt-400mi_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:ntt-east:rv-440mi_firmware:-:*:*:*:*:*:*:*"], "vendor": "ntt-east", "product": "rv-440mi_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "09.00.0015"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:ntt-east:pr-500mi_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:ntt-east:rs-500mi_firmware:-:*:*:*:*:*:*:*", "cpe:2.3:o:ntt-east:rt-500mi_firmware:-:*:*:*:*:*:*:*"], "vendor": "ntt-east", "product": "rt-500mi_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "08.00.0004"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:ntt-east:pr-600mi_firmware:*:*:*:*:*:*:*:*", "cpe:2.3:o:ntt-east:rx-600mi_firmware:*:*:*:*:*:*:*:*"], "vendor": "ntt-east", "product": "rx-600mi_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "01.00.0008"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-26T18:33:10.450Z"}}], "cna": {"affected": [{"vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION", "product": "Hikari Denwa router RT-400MI", "versions": [{"status": "affected", "version": "Ver.09.00.0015 and earlier"}]}, {"vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION", "product": "Hikari Denwa router PR-400MI", "versions": [{"status": "affected", "version": "Ver.09.00.0015 and earlier"}]}, {"vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION", "product": "Hikari Denwa router RV-440MI", "versions": [{"status": "affected", "version": "Ver.09.00.0015 and earlier"}]}, {"vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION", "product": "Home GateWay/Hikari Denwa router PR-500MI/RS-500MI/RT-500MI", "versions": [{"status": "affected", "version": "Ver.08.00.0004 and earlier"}]}, {"vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION", "product": "Home GateWay/Hikari Denwa router PR-600MI/RX-600MI", "versions": [{"status": "affected", "version": "Ver.01.00.0008 and earlier"}]}], "references": [{"url": "https://web116.jp/ced/support/news/contents/2024/20240930.html"}, {"url": "https://web116.jp/ced/support/version/broadband/rt_400mi/"}, {"url": "https://web116.jp/ced/support/version/broadband/pr_400mi/"}, {"url": "https://web116.jp/ced/support/version/broadband/rv_440mi/"}, {"url": "https://web116.jp/ced/support/version/broadband/500mi/"}, {"url": "https://web116.jp/ced/support/version/broadband/600mi/"}, {"url": "https://jvn.jp/en/jp/JVN78356367/"}], "descriptions": [{"lang": "en", "value": "Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for Device Setting pages. If this vulnerability is exploited, an attacker who identified WAN-side IPv6 address may access the product's Device Setting page via WAN-side. Note that, the same products are also provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION, but the vulnerability only affects products subscribed and used in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION areas."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-451", "description": "User interface (UI) misrepresentation of critical information"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-10-17T01:33:49.083Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47044", "state": "PUBLISHED", "dateUpdated": "2024-10-17T01:33:49.083Z", "dateReserved": "2024-09-17T04:53:47.412Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-09-26T08:34:30.347Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for Device Setting pages. If this vulnerability is exploited, an attacker who identified WAN-side IPv6 address may access the product's Device Setting page via WAN-side. Note that, the same products are also provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION, but the vulnerability only affects products subscribed and used in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION areas."}, {"lang": "es", "value": "Varios enrutadores Home GateWay/Hikari Denwa proporcionados por NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION son vulnerables a restricciones de acceso insuficientes para las p\u00e1ginas de configuraci\u00f3n de dispositivos. Si se explota esta vulnerabilidad, un atacante que identifique la direcci\u00f3n IPv6 del lado WAN puede acceder a la p\u00e1gina de configuraci\u00f3n de dispositivos del producto a trav\u00e9s del lado WAN. Tenga en cuenta que NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION tambi\u00e9n proporciona los mismos productos, pero la vulnerabilidad solo afecta a los productos suscritos y utilizados en las \u00e1reas de NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION."}], "id": "CVE-2024-47044", "lastModified": "2024-10-17T02:15:02.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-09-26T09:15:02.317", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN78356367/"}, {"source": "vultures@jpcert.or.jp", "url": "https://web116.jp/ced/support/news/contents/2024/20240930.html"}, {"source": "vultures@jpcert.or.jp", "url": "https://web116.jp/ced/support/version/broadband/500mi/"}, {"source": "vultures@jpcert.or.jp", "url": "https://web116.jp/ced/support/version/broadband/600mi/"}, {"source": "vultures@jpcert.or.jp", "url": "https://web116.jp/ced/support/version/broadband/pr_400mi/"}, {"source": "vultures@jpcert.or.jp", "url": "https://web116.jp/ced/support/version/broadband/rt_400mi/"}, {"source": "vultures@jpcert.or.jp", "url": "https://web116.jp/ced/support/version/broadband/rv_440mi/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-451"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}