CVE-2024-36454 (GCVE-0-2024-36454)

Vulnerability from cvelistv5 – Published: 2024-06-12 05:12 – Updated: 2024-08-02 03:37
VLAI?
Summary
Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 and earlier. If this vulnerability is exploited, the system may be rebooted or suspended by receiving a specially crafted packet.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Use of Uninitialized Resource
Assigner
References
Impacted products
Vendor Product Version
Fsas Technologies Inc. IPCOM EX2 Series (V01L0x Series) Affected: V01L07NF0201 and earlier
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:fujitsu:ipcom_ex2_in_3200_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:fujitsu:ipcom_ex2_in_3500_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:fujitsu:ipcom_ex2_lb_3200_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:fujitsu:ipcom_ex2_lb_3500_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:fujitsu:ipcom_ex2_sc_3200_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:fujitsu:ipcom_ex2_sc_3500_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ipcom_ex2_sc_3500_firmware",
            "vendor": "fujitsu",
            "versions": [
              {
                "lessThanOrEqual": "01l07nf0201",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:fujitsu:ipcom_ve2_ls_plus_100_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:fujitsu:ipcom_ve2_ls_plus_200_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:fujitsu:ipcom_ve2_ls_plus2_200_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:fujitsu:ipcom_ve2_ls_plus_220_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:fujitsu:ipcom_ve2_ls_plus2_220_firmware:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ipcom_ve2_ls_plus2_220_firmware",
            "vendor": "fujitsu",
            "versions": [
              {
                "lessThanOrEqual": "01l07nf0201",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36454",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-16T18:17:41.103809Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-908",
                "description": "CWE-908 Use of Uninitialized Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-16T18:27:45.717Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:37:05.198Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.fujitsu.com/jp/products/network/support/2024/ipcom-02/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN25594256/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "IPCOM EX2 Series (V01L0x Series)",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V01L07NF0201 and earlier"
            }
          ]
        },
        {
          "product": "IPCOM VE2 Series",
          "vendor": "Fsas Technologies Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "V01L07NF0201 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 and earlier. If this vulnerability is exploited, the system may be rebooted or suspended by receiving a specially crafted packet."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use of Uninitialized Resource",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-12T05:12:24.382Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.fujitsu.com/jp/products/network/support/2024/ipcom-02/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN25594256/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-36454",
    "datePublished": "2024-06-12T05:12:24.382Z",
    "dateReserved": "2024-05-28T08:11:26.050Z",
    "dateUpdated": "2024-08-02T03:37:05.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 and earlier. If this vulnerability is exploited, the system may be rebooted or suspended by receiving a specially crafted packet.\"}, {\"lang\": \"es\", \"value\": \"El problema del uso de recursos no inicializados existe en IPCOM EX2 Series (V01L0x Series) V01L07NF0201 y anteriores, y en IPCOM VE2 Series V01L07NF0201 y anteriores. Si se aprovecha esta vulnerabilidad, el sistema puede reiniciarse o suspenderse al recibir un paquete especialmente manipulado.\"}]",
      "id": "CVE-2024-36454",
      "lastModified": "2024-11-21T09:22:13.247",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
      "published": "2024-06-12T06:15:09.127",
      "references": "[{\"url\": \"https://jvn.jp/en/jp/JVN25594256/\", \"source\": \"vultures@jpcert.or.jp\"}, {\"url\": \"https://www.fujitsu.com/jp/products/network/support/2024/ipcom-02/\", \"source\": \"vultures@jpcert.or.jp\"}, {\"url\": \"https://jvn.jp/en/jp/JVN25594256/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.fujitsu.com/jp/products/network/support/2024/ipcom-02/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "vultures@jpcert.or.jp",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-908\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36454\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2024-06-12T06:15:09.127\",\"lastModified\":\"2024-11-21T09:22:13.247\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 and earlier. If this vulnerability is exploited, the system may be rebooted or suspended by receiving a specially crafted packet.\"},{\"lang\":\"es\",\"value\":\"El problema del uso de recursos no inicializados existe en IPCOM EX2 Series (V01L0x Series) V01L07NF0201 y anteriores, y en IPCOM VE2 Series V01L07NF0201 y anteriores. Si se aprovecha esta vulnerabilidad, el sistema puede reiniciarse o suspenderse al recibir un paquete especialmente manipulado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN25594256/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.fujitsu.com/jp/products/network/support/2024/ipcom-02/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://jvn.jp/en/jp/JVN25594256/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.fujitsu.com/jp/products/network/support/2024/ipcom-02/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36454\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-16T18:17:41.103809Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:fujitsu:ipcom_ex2_in_3200_firmware:-:*:*:*:*:*:*:*\", \"cpe:2.3:o:fujitsu:ipcom_ex2_in_3500_firmware:-:*:*:*:*:*:*:*\", \"cpe:2.3:o:fujitsu:ipcom_ex2_lb_3200_firmware:-:*:*:*:*:*:*:*\", \"cpe:2.3:o:fujitsu:ipcom_ex2_lb_3500_firmware:-:*:*:*:*:*:*:*\", \"cpe:2.3:o:fujitsu:ipcom_ex2_sc_3200_firmware:-:*:*:*:*:*:*:*\", \"cpe:2.3:o:fujitsu:ipcom_ex2_sc_3500_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"fujitsu\", \"product\": \"ipcom_ex2_sc_3500_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"01l07nf0201\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:fujitsu:ipcom_ve2_ls_plus_100_firmware:-:*:*:*:*:*:*:*\", \"cpe:2.3:o:fujitsu:ipcom_ve2_ls_plus_200_firmware:-:*:*:*:*:*:*:*\", \"cpe:2.3:o:fujitsu:ipcom_ve2_ls_plus2_200_firmware:-:*:*:*:*:*:*:*\", \"cpe:2.3:o:fujitsu:ipcom_ve2_ls_plus_220_firmware:-:*:*:*:*:*:*:*\", \"cpe:2.3:o:fujitsu:ipcom_ve2_ls_plus2_220_firmware:-:*:*:*:*:*:*:*\"], \"vendor\": \"fujitsu\", \"product\": \"ipcom_ve2_ls_plus2_220_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"01l07nf0201\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-908\", \"description\": \"CWE-908 Use of Uninitialized Resource\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-16T18:18:58.948Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"IPCOM EX2 Series (V01L0x Series)\", \"versions\": [{\"status\": \"affected\", \"version\": \"V01L07NF0201 and earlier\"}]}, {\"vendor\": \"Fsas Technologies Inc.\", \"product\": \"IPCOM VE2 Series\", \"versions\": [{\"status\": \"affected\", \"version\": \"V01L07NF0201 and earlier\"}]}], \"references\": [{\"url\": \"https://www.fujitsu.com/jp/products/network/support/2024/ipcom-02/\"}, {\"url\": \"https://jvn.jp/en/jp/JVN25594256/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 and earlier. If this vulnerability is exploited, the system may be rebooted or suspended by receiving a specially crafted packet.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Use of Uninitialized Resource\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2024-06-12T05:12:24.382Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36454\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-07-16T18:27:45.717Z\", \"dateReserved\": \"2024-05-28T08:11:26.050Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2024-06-12T05:12:24.382Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.