CVE-2024-21865 - Vulnerability Details - OpenCVE

HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://jvn.jp/en/vu/JVNVU93546510/
https://kddi-tech.com/contents/appendix_L2_06.html#20304f4c-af1b-49fd-c3b5-8d1f55fd8b4f
https://www.au.com/support/service/internet/guide/modem/bl1500hm/firmware/

History

Fri, 28 Mar 2025 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1391
References		https://kddi-tech.com/contents/appendix_L2_06.html#20304f4c-af1b-49fd-c3b5-8d1f55fd8b4f

Sun, 27 Oct 2024 03:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-521
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-03-25T04:11:34.280Z

Updated: 2025-03-28T07:38:26.719Z

Reserved: 2024-03-18T01:23:32.331Z

Link: CVE-2024-21865

Vulnrichment

Updated: 2024-08-01T22:27:36.343Z

NVD

Status : Awaiting Analysis

Published: 2024-03-25T05:15:50.863

Modified: 2025-03-28T08:15:13.337

Link: CVE-2024-21865

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21865", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-03-18T01:23:32.331Z", "datePublished": "2024-03-25T04:11:34.280Z", "dateUpdated": "2025-03-28T07:38:26.719Z"}, "containers": {"cna": {"affected": [{"vendor": "KDDI CORPORATION", "product": "HGW BL1500HM", "versions": [{"version": "Ver 002.001.013 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell."}], "problemTypes": [{"descriptions": [{"description": "Use of weak credentials", "lang": "en-US", "cweId": "CWE-1391", "type": "CWE"}]}], "references": [{"url": "https://kddi-tech.com/contents/appendix_L2_06.html#20304f4c-af1b-49fd-c3b5-8d1f55fd8b4f"}, {"url": "https://jvn.jp/en/vu/JVNVU93546510/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-03-28T07:38:26.719Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-521", "lang": "en", "description": "CWE-521 Weak Password Requirements"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-17T15:29:40.852705Z", "id": "CVE-2024-21865", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-27T02:14:16.828Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:27:36.343Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.au.com/support/service/internet/guide/modem/bl1500hm/firmware/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/vu/JVNVU93546510/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.au.com/support/service/internet/guide/modem/bl1500hm/firmware/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/vu/JVNVU93546510/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:27:36.343Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-21865", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-17T15:29:40.852705Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-521", "description": "CWE-521 Weak Password Requirements"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-17T15:29:46.986Z"}}], "cna": {"affected": [{"vendor": "KDDI CORPORATION", "product": "HGW BL1500HM", "versions": [{"status": "affected", "version": "Ver 002.001.013 and earlier"}]}], "references": [{"url": "https://kddi-tech.com/contents/appendix_L2_06.html#20304f4c-af1b-49fd-c3b5-8d1f55fd8b4f"}, {"url": "https://jvn.jp/en/vu/JVNVU93546510/"}], "descriptions": [{"lang": "en", "value": "HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-1391", "description": "Use of weak credentials"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-03-28T07:38:26.719Z"}}}, "cveMetadata": {"cveId": "CVE-2024-21865", "state": "PUBLISHED", "dateUpdated": "2025-03-28T07:38:26.719Z", "dateReserved": "2024-03-18T01:23:32.331Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-03-25T04:11:34.280Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}