CVE-2024-28020 Hardcoded credentials in FOXMAN-UN
A malicious high-privileged user can reuse credentials to extend access on the server and other services in Hitachi Energy FOXMAN-UN/UNEM.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-28020?
CVE-2024-28020 is a high-severity vulnerability in Hitachi Energy FOXMAN-UN, published on 11 Jun 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a malicious high-privileged user could use the passwords and login information through complex routines to extend access on the server and other services.
Weakness: CWE-286
Which versions are affected by CVE-2024-28020?
It affects 2 products.
Products include Hitachienergy Foxman-Un, Hitachienergy Unem.
How do I fix CVE-2024-28020?
No fix has been published for CVE-2024-28020 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-28020 being exploited?
There is no known exploitation of CVE-2024-28020 in the wild and no public exploit code.
Other vulnerabilities in Hitachi Energy FOXMAN-UN
Sources
Also known as GHSA-94mv-6g8w-jxvx.