Hitachi Energy FOXMAN-UN

• CVE-2024-28020 High 8.0 A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a malicious high-privileged user could use the passwords and login information through 0.4%
• CVE-2024-28024 Medium 4.1 A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessible to another control sphere. 0.1%
• CVE-2024-28022 Medium 6.5 A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different passwords, and eventually gai 0.4%
• CVE-2024-28023 Medium 5.7 A vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive in 0.2%
• CVE-2024-28021 High 7.4 A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation. If exploited an attacker could spoof a trusted entity causing a loss of confi 0.3%
• CVE-2024-2011 High 8.6 A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but can be used to execute arbitrary code, which is usually outsid 0.5%
• CVE-2024-2012 Critical 9.1 vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server allowing sensitive data 0.6%
• CVE-2024-2013 Critical 10.0 An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the services and the post-aut 0.7%
• CVE-2024-2462 Medium 6.8 Allow attackers to intercept or falsify data exchanges between the client and the server 0.2%
• CVE-2023-1711 Medium 4.0 A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elements. If exploited an attacker could obtain confidential in 0.2%
• CVE-2022-3929 High 8.3 Communication between the client and server partially using CORBA over TCP/IP 0.4%
• CVE-2022-3928 High 7.1 Hardcoded credential is found in the message queue 0.2%
• CVE-2022-3927 High 8.0 The affected products store public and private key that are used to sign and protect custom parameter set files from modification. 0.6%
• CVE-2021-40342 High 7.1 Use of default key for encryption 0.3%
• CVE-2021-40341 High 7.1 Weak DES encryption <0.1%