Lucene search

JpcertCVE-2024-28957

HistoryApr 15, 2024 - 11:15 a.m.

CVE-2024-28957

2024-04-1511:15:08

CWE-340

jpcert

web.nvd.nist.gov

cente middleware

tcp/ip network

predictable identifiers

vulnerability

exploitation

remote unauthenticated attacker

communications

packet header ids

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

Confidence

Low

EPSS

Percentile

15.5%

JSON

Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series. If this vulnerability is exploited, a remote unauthenticated attacker may interfere communications by predicting some packet header IDs of the device.

Affected configurations

Vulners

Node

dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_tcp\/ipv4Match1.41

dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_tcp\/ipv4_snmpv2Match2.30

dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_tcp\/ipv4_snmpv3Match2.30

dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_ipv6Match1.51

dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_ipv6_snmpv2Match2.30

dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_ipv6_snmpv3Match2.30

VendorProductVersionCPE
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_tcp\/ipv41.41cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_tcp\/ipv4:1.41:*:*:*:*:*:*:*
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_tcp\/ipv4_snmpv22.30cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_tcp\/ipv4_snmpv2:2.30:*:*:*:*:*:*:*
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_tcp\/ipv4_snmpv32.30cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_tcp\/ipv4_snmpv3:2.30:*:*:*:*:*:*:*
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_ipv61.51cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_ipv6:1.51:*:*:*:*:*:*:*
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_ipv6_snmpv22.30cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_ipv6_snmpv2:2.30:*:*:*:*:*:*:*
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.cente_ipv6_snmpv32.30cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_ipv6_snmpv3:2.30:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.	cente_tcp\/ipv4	1.41	cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_tcp\/ipv4:1.41:::::::*
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.	cente_tcp\/ipv4_snmpv2	2.30	cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_tcp\/ipv4_snmpv2:2.30:::::::*
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.	cente_tcp\/ipv4_snmpv3	2.30	cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_tcp\/ipv4_snmpv3:2.30:::::::*
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.	cente_ipv6	1.51	cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_ipv6:1.51:::::::*
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.	cente_ipv6_snmpv2	2.30	cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_ipv6_snmpv2:2.30:::::::*
dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.	cente_ipv6_snmpv3	2.30	cpe:2.3:a:dmg_mori_digital_co.\,_ltd._and_next_co.\,_ltd.:cente_ipv6_snmpv3:2.30:::::::*

CNA Affected

[
  {
    "vendor": "DMG MORI Digital Co., LTD. and NEXT Co., Ltd.",
    "product": "Cente TCP/IPv4",
    "versions": [
      {
        "version": "Ver.1.41 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "DMG MORI Digital Co., LTD. and NEXT Co., Ltd.",
    "product": "Cente TCP/IPv4 SNMPv2",
    "versions": [
      {
        "version": "Ver.2.30 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "DMG MORI Digital Co., LTD. and NEXT Co., Ltd.",
    "product": "Cente TCP/IPv4 SNMPv3",
    "versions": [
      {
        "version": "Ver.2.30 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "DMG MORI Digital Co., LTD. and NEXT Co., Ltd.",
    "product": "Cente IPv6",
    "versions": [
      {
        "version": "Ver.1.51 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "DMG MORI Digital Co., LTD. and NEXT Co., Ltd.",
    "product": "Cente IPv6 SNMPv2",
    "versions": [
      {
        "version": "Ver.2.30 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "DMG MORI Digital Co., LTD. and NEXT Co., Ltd.",
    "product": "Cente IPv6 SNMPv3",
    "versions": [
      {
        "version": "Ver.2.30 and earlier",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/vu/JVNVU94016877/

www.cente.jp/obstacle/4956/

www.cente.jp/obstacle/4963/

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

Confidence

Low

EPSS

Percentile

15.5%

JSON

Related for CVE-2024-28957