FKIE_CVE-2024-41156

Vulnerability from fkie_nvd - Published: 2024-10-29 13:15 - Updated: 2024-12-05 15:29
Severity ?
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Summary
Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers valuable configuration information about the Tropos network. Profiles can only be exported by authenticated users with higher privilege of write access.
References
cybersecurity@hitachienergy.comhttps://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&DocumentPartId=&Action=launchVendor Advisory
Impacted products
Vendor Product Version
hitachienergy tro610_firmware *
hitachienergy tro610 -
hitachienergy tro620_firmware *
hitachienergy tro620 -
hitachienergy tro670_firmware *
hitachienergy tro670 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:hitachienergy:tro610_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5C2D2E0-5383-44E5-B8C6-C743503A8E51",
              "versionEndExcluding": "9.2.0.5",
              "versionStartIncluding": "9.1.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:hitachienergy:tro610:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3A46C6E-9314-40EB-A8BE-0D3A26B5FE4C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:hitachienergy:tro620_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BE01813-8087-4E9B-8B2B-FF813C0E9506",
              "versionEndExcluding": "9.2.0.5",
              "versionStartIncluding": "9.1.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:hitachienergy:tro620:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC979E74-6316-4BED-87A6-4DC9B9747E0F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:hitachienergy:tro670_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6A94F87-2875-46C9-8BD3-BE3EA9F71648",
              "versionEndExcluding": "9.2.0.5",
              "versionStartIncluding": "9.1.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:hitachienergy:tro670:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E84F6910-1D58-4AE7-94EF-797C9BD52690",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Profile files from TRO600 series radios are extracted in plain-text\nand encrypted file formats. Profile files provide potential attackers\nvaluable configuration information about the Tropos network. Profiles\ncan only be exported by authenticated users with higher privilege of write access."
    },
    {
      "lang": "es",
      "value": " Los archivos de perfil de las radios de la serie TRO600 se extraen en formato de texto plano y en formato de archivo cifrado. Los archivos de perfil proporcionan a los posibles atacantes informaci\u00f3n valiosa sobre la configuraci\u00f3n de la red Tropos. Los perfiles solo pueden ser exportados por usuarios autenticados con acceso de escritura."
    }
  ],
  "id": "CVE-2024-41156",
  "lastModified": "2024-12-05T15:29:31.730",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 1.4,
        "source": "cybersecurity@hitachienergy.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-10-29T13:15:04.847",
  "references": [
    {
      "source": "cybersecurity@hitachienergy.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=launch"
    }
  ],
  "sourceIdentifier": "cybersecurity@hitachienergy.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-212"
        }
      ],
      "source": "cybersecurity@hitachienergy.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-212"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.