Exposure of Sensitive System Information to an Unauthorized Control Sphere in NTT DOCOMO products - CVE-2024-52321

Vulnerability identifier: #VU101786

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-52321

CWE-ID: CWE-497

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper authentication in the configuration backup function. A remote attacker can gain unauthorized access to sensitive information on the system.

home 5G HR02
Wi-Fi STATION SH-52B
Wi-Fi STATION SH-54C
Wi-Fi STATION SH-05L
PocketWifi 809SH
Speed Wi-Fi NEXT W07

Install updates from vendor's website.

home 5G HR02 - update to S5.85.00
Wi-Fi STATION SH-52B - update to S3.87.14
Wi-Fi STATION SH-54C - update to S6.63.00
Wi-Fi STATION SH-05L - update to 01.00.C2
PocketWifi 809SH - update to 01.00.C2
Speed Wi-Fi NEXT W07 - update to 02.00.50

• https://jvn.jp/en/jp/JVN61635834/index.html

• Multiple vulnerabilities in SHARP routers for NTT DOCOMO
• Multiple vulnerabilities in SHARP routers for SoftBank
• Multiple vulnerabilities in SHARP routers for KDDI CORPORATION