Log in Start free

Vulnerability · Published Sep 26, 2024 · Assigned by jpcert

CVE-2024-47044

Medium 5.3

In plain English

A medium-severity security flaw in Hikari Denwa router PR-400MI from NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 62.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for Device Setting pages. If this vulnerability is exploited, an attacker who identified WAN-side IPv6 address may access the product's Device Setting page via WAN-side. Note that, the same products are also provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION, but the vulnerability only affects products subscribed and used in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION areas.

Affected products (as reported)

VendorProductVersions
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Hikari Denwa router RT-400MI Ver.09.00.0015 and earlier
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Hikari Denwa router PR-400MI Ver.09.00.0015 and earlier
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Hikari Denwa router RV-440MI Ver.09.00.0015 and earlier
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Home GateWay/Hikari Denwa router PR-500MI/RS-500MI/RT-500MI Ver.08.00.0004 and earlier
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Home GateWay/Hikari Denwa router PR-600MI/RX-600MI Ver.01.00.0008 and earlier

Weakness: CWE-451 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References