JVN#25583987
FUJITSU Network Edgiot GW1500 vulnerable to path traversal
Overview
FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS) provided by Fujitsu Limited contains a path traversal vulnerability.
Products Affected
- FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS) versions prior to V02L19C01
Description
FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS) provided by Fujitsu Limited contains a path traversal vulnerability (CWE-22).
Impact
If a logged-in attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result, Administrator Class privileges of the product may be hijacked.
Solution
Apply the Patch
Apply the patch according to the information provided by the developer.
Apply the Workaround
The following workaround may mitigate the impact of this vulnerability.
- Change Administrator Class's password when resetting the initial configuration of the product
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
Comment
The analysis evaluates "Confidentiality(C)" as the primary impact where the internal file containing sensitive information is accessible, whereas treating "Integrity(I)" and "Availability(A)" as secondary impacts.
Credit
Eddy HUYNH & Jonathan PAUC from LCIE - BUREAU VERITAS CPS reported this vulnerability to Fujitsu Limited and coordinated. After the coordination was completed, Fujitsu Limited reported the case to JPCERT/CC to notify users of the solution through JVN.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2024-40617 |
| JVN iPedia |
JVNDB-2024-000071 |