[Japanese]

JVNDB-2024-000071

FUJITSU Network Edgiot GW1500 vulnerable to path traversal

Overview

FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS) provided by Fujitsu Limited contains a path traversal vulnerability (CWE-22).

Eddy HUYNH & Jonathan PAUC from LCIE - BUREAU VERITAS CPS reported this vulnerability to Fujitsu Limited and coordinated. After the coordination was completed, Fujitsu Limited reported the case to JPCERT/CC to notify users of the solution through JVN.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 6.5 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None
Affected Products


FUJITSU
  • FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS) versions prior to V02L19C01

Note that the products is affected only when using it with the factory shipped initial configuration.
Impact

If a logged-in attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result, Administrator Class privileges of the product may be hijacked.
Solution

[Apply the Patch]
Apply the patch according to the information provided by the developer.

[Apply the Workaround]
The following workaround may mitigate the impact of this vulnerability.
* Change Administrator Class's password when resetting the initial configuration of the product
Vendor Information

FUJITSU
CWE (What is CWE?)

  1. Path Traversal(CWE-22) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2024-40617
References

  1. JVN : JVN#25583987
Revision History

  • [2024/7/16]
      Web page was published

Date Public2024/07/16
Date First Published2024/07/16
Date Last Updated2024/07/16