Cross-site request forgery in NEC Corporation products - CVE-2024-11014

Vulnerability identifier: #VU101069

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-11014

CWE-ID: CWE-352

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

IX3315
IX3110
IX2105
IX2106
IX2107
IX2207
IX3015
IX2310
IX2235
IX2025
IX2215

Install update from vendor's website.

IX3315 - addressed in versions 10.8.33, 10.9.20, 10.10.27
IX3110 - addressed in versions 10.8.33, 10.9.20, 10.10.27
IX2105 - addressed in versions 10.8.33, 10.9.20, 10.10.27
IX2106 - addressed in versions 10.8.33, 10.9.20, 10.10.27
IX2107 - addressed in versions 10.8.33, 10.9.20, 10.10.27
IX2207 - addressed in versions 10.8.33, 10.9.20, 10.10.27
IX3015 - addressed in versions 10.8.33, 10.9.20, 10.10.27
IX2310 - addressed in versions 10.8.33, 10.9.20, 10.10.27
IX2235 - addressed in versions 10.8.33, 10.9.20, 10.10.27
IX2025 - addressed in versions 10.8.33, 10.9.20, 10.10.27
IX2215 - addressed in versions 10.8.33, 10.9.20, 10.10.27

• https://https://jpn.nec.com/security-info/secinfo/nv24-009_en.html
• https://jvn.jp/en/jp/JVN53958863/index.html

• Multiple vulnerabilities in NEC Corporation UNIVERGE IX/IX-R/IX-V series routers