CVE-2024-41156 Information disclosure in TRO600
Authenticated users with write access can export plain-text profile files, exposing sensitive network configuration information.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41156?
CVE-2024-41156 is a low-severity vulnerability in Hitachi Energy TRO600, published on 29 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats. Profile files provide potential attackers valuable configuration information about the Tropos network. Profiles can only be exported by authenticated users with higher privilege of write access.
Weakness: CWE-212
Which versions are affected by CVE-2024-41156?
It affects 3 products.
Products include Hitachienergy Tro610 Firmware, Hitachienergy Tro620 Firmware, Hitachienergy Tro670 Firmware.
How do I fix CVE-2024-41156?
No fix has been published for CVE-2024-41156 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-41156 being exploited?
There is no known exploitation of CVE-2024-41156 in the wild and no public exploit code.
Other vulnerabilities in Hitachi Energy TRO600
Sources
Also known as GHSA-9xqp-xm5r-jj9c.