CVE-2024-2013 Auth bypass in FOXMAN-UN
Attackers can bypass authentication to access services and post-authentication surfaces in Hitachi Energy FOXMAN-UN/UNEM servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2013?
CVE-2024-2013 is a critical authentication bypass vulnerability in Hitachi Energy FOXMAN-UN, published on 11 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the services and the post-authentication attack surface.
Which versions are affected by CVE-2024-2013?
It affects 2 products.
Products include Hitachienergy Foxman-Un, Hitachienergy Unem.
How do I fix CVE-2024-2013?
No fix has been published for CVE-2024-2013 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-2013 being exploited?
There is no known exploitation of CVE-2024-2013 in the wild and no public exploit code.
Other vulnerabilities in Hitachi Energy FOXMAN-UN
Sources
Also known as GHSA-fc83-86ww-f7qw.