Active Debug Code in NTT DOCOMO products - CVE-2024-46873

Vulnerability identifier: #VU101784

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-46873

CWE-ID: CWE-489

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the hidden debug function is enabled. A remote attacker can execute arbitrary commands on the system.

home 5G HR02
Wi-Fi STATION SH-52B
Wi-Fi STATION SH-54C
Wi-Fi STATION SH-05L
PocketWifi 809SH
Speed Wi-Fi NEXT W07

Install updates from vendor's website.

home 5G HR02 - update to S5.85.00
Wi-Fi STATION SH-52B - update to S3.87.14
Wi-Fi STATION SH-54C - update to S6.63.00
Wi-Fi STATION SH-05L - update to 01.00.C2
PocketWifi 809SH - update to 01.00.C2
Speed Wi-Fi NEXT W07 - update to 02.00.50

• https://jvn.jp/en/jp/JVN61635834/index.html

• Multiple vulnerabilities in SHARP routers for NTT DOCOMO
• Multiple vulnerabilities in SHARP routers for SoftBank
• Multiple vulnerabilities in SHARP routers for KDDI CORPORATION