PT-2024-16702 · Nec · Univerge Ix

Ryotak · Published 2024-11-29 · Updated 2024-11-30 · CVE-2024-11014

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NEC Corporation UNIVERGE IX versions 9.2 through 10.10.21 NEC Corporation UNIVERGE IX versions 10.8 through 10.8.27 NEC Corporation UNIVERGE IX versions 10.9 through 10.9.14

Description The issue allows an attacker to hijack the authentication of screens on the device via the management interface. This is a Cross-site request forgery (CSRF) vulnerability, which can be exploited to seize control of the device's authentication.

Recommendations For versions 9.2 through 10.10.21, update to a version later than 10.10.21 to resolve the issue. For versions 10.8 through 10.8.27, update to a version later than 10.8.27 to resolve the issue. For versions 10.9 through 10.9.14, update to a version later than 10.9.14 to resolve the issue. As a temporary workaround, consider restricting access to the management interface to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-11014

Affected Products

Univerge Ix

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-11014 · Security Note
• https://twitter.com/VulmonFeeds/status/1862654923176898966 · Twitter Post
• https://https//jpn.nec.com/security-info/secinfo/nv24-009_en.html · Note
• https://twitter.com/CVEnew/status/1862411090975760787 · Twitter Post
• https://jpn.nec.com/security-info/secinfo/nv24-009_en.html · Note