« Volver al listado

CVE-2024-28022

Estado: AnalizadaMedia (6.5)—

A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to other components in the same security realm using the targeted account.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Hitachienergy — Foxman-unHitachienergy — Unem

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-28022",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-28022",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-12T19:32:31.382514Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cybersecurity@hitachienergy.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@hitachienergy.com",
      "affectedData": [
        {
          "vendor": "Hitachi Energy",
          "product": "FOXMAN-UN",
          "versions": [
            {
              "status": "affected",
              "version": "FOXMAN-UN R16B"
            },
            {
              "status": "affected",
              "version": "FOXMAN-UN R15B"
            },
            {
              "status": "affected",
              "version": "FOXMAN-UN R16A"
            },
            {
              "status": "affected",
              "version": "FOXMAN-UN R15A"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Hitachi Energy",
          "product": "UNEM",
          "versions": [
            {
              "status": "affected",
              "version": "UNEM R16B"
            },
            {
              "status": "affected",
              "version": "UNEM R15B"
            },
            {
              "status": "affected",
              "version": "UNEM 16A"
            },
            {
              "status": "affected",
              "version": "UNEM 15A"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-06-11T19:16:06.017",
  "references": [
    {
      "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cybersecurity@hitachienergy.com"
    },
    {
      "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cybersecurity@hitachienergy.com"
    },
    {
      "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@hitachienergy.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of\nauthentication attempts using different passwords, and eventually\ngain access to other components in the same security realm using\nthe targeted account."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad en el servidor/APIGateway de FOXMAN-UN/UNEM que, si se explota, permite a un usuario malintencionado realizar un número arbitrario de intentos de autenticación utilizando diferentes contraseñas y, finalmente, obtener acceso a la cuenta objetivo."
    }
  ],
  "lastModified": "2026-06-17T07:20:49.573",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hitachienergy:foxman-un:r15a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7593C74-2882-45D3-AB32-3A45E3AECAAE"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:foxman-un:r15b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47606044-296D-4561-B9DC-82659BC666F2"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:foxman-un:r16a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EE987B2-0620-44BB-AEA7-4E20CBE44822"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:foxman-un:r16b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE743C56-A17F-4FA7-9998-0C767E07518A"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:unem:r15a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E78C9E5B-5876-4F15-A98A-359193287446"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:unem:r15b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3168F38-7B9E-4F4D-B6D0-1BAFB5FE05F5"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:unem:r16a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7ABB4A53-07A0-4F9A-824B-A1AC71CCB44E"
            },
            {
              "criteria": "cpe:2.3:a:hitachienergy:unem:r16b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADA6755A-0553-4246-B462-7580B080FDEF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cybersecurity@hitachienergy.com"
}