Improper Authentication in Fujitsu products - CVE-2023-38555

Vulnerability identifier: #VU78676

CSH Severity: Low

CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2023-38555

CWE-ID: CWE-287

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerable software:
Si-R 30B
Si-R 130B
Si-R 90brin
Si-R570B
Si-R370B
Si-R220D
Si-R G100
Si-R G200
Si-R G100B
Si-R G110B
Si-R G200B
Si-R G210
Si-R G211
Si-R G120
Si-R G121
SR-M 50AP1

Software vendor:
Fujitsu

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests in the web management interface. A remote attacker on the local network can obtain the product's configuration information or change/reset the configuration settings.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://jvn.jp/en/vu/JVNVU96643580/index.html
• https://www.fujitsu.com/jp/products/network/support/2023/fjlan-01/