CVE-2024-28744

2024-04-0800:16:21

jpcert

www.cve.org

cve-2024-28744

empty password

acera 9010-08

acera 9010-24

firmware vulnerability

unauthenticated access

AI Score

6.9

Confidence

Low

EPSS

Percentile

9.0%

JSON

The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as network configuration and user information. The products are affected only when running in non MS mode with the initial configuration.

CNA Affected

[
  {
    "vendor": "FURUNO SYSTEMS Co.,Ltd.",
    "product": "ACERA 9010-08",
    "versions": [
      {
        "version": "firmware v02.04 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "FURUNO SYSTEMS Co.,Ltd.",
    "product": "ACERA 9010-24",
    "versions": [
      {
        "version": "firmware v02.04 and earlier",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/vu/JVNVU99285099/

www.furunosystems.co.jp/news/info/vulner20240401.html