CVE-2024-28022

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-28022
A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to other components in the same security realm using the targeted account.

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true Vendor Advisory
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true Vendor Advisory
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true Vendor Advisory
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:hitachienergy:unem:r15b:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:unem:r15a:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:unem:r16a:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:foxman-un:r15b:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:foxman-un:r15a:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:foxman-un:r16a:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:unem:r16b:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:foxman-un:r16b:*:*:*:*:*:*:*
History

30 Oct 2024, 14:24

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 5.6 		v2 : unknown
v3 : 6.5

29 Oct 2024, 15:15

Type Values Removed Values Added
Summary A vulnerability exists in the FOXMAN-UN/UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account. A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to other components in the same security realm using the targeted account.

15 Aug 2024, 21:44

Type Values Removed Values Added
CPE cpe:2.3:a:hitachienergy:unem:r15a:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:unem:r16a:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:unem:r16b:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:foxman-un:r15a:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:unem:r15b:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:foxman-un:r16a:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:foxman-un:r16b:*:*:*:*:*:*:*
cpe:2.3:a:hitachienergy:foxman-un:r15b:*:*:*:*:*:*:*
References () https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true - () https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true - Vendor Advisory
References () https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true - () https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true - Vendor Advisory
CWE CWE-307
First Time Hitachienergy foxman-un
Hitachienergy
Hitachienergy unem
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.6

11 Jun 2024, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-11 19:16

Updated : 2025-04-29 19:40

NVD link : CVE-2024-28022

Mitre link : CVE-2024-28022

JSON object : View

Products Affected

hitachienergy

  • unem
  • foxman-un
CWE
CWE-307

Improper Restriction of Excessive Authentication Attempts