Use of Hard-coded Cryptographic Key in AIPHONE products - CVE-2024-45837

Vulnerability identifier: #VU98818

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-45837

CWE-ID: CWE-321

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to use of hard-coded cryptographic key. A remote attacker on the local network can log in to SFTP service and obtain and/or manipulate unauthorized files.

IX-BBT
IX-EAU
IX-DV
IX-DVT
IXG-DM7
IX-DVF
IX-DVF-P
IXG-2C7-L
IX-DVF-L
IX-DVM
IX-DU
IX-DVF-RA
IX-DVF-2RA
IX-BA
IX-BAU
IX-BB
IXG-DM7-HID
IX-FA
IX-SSA
IXG-2C7
IX-SS-2G
IX-SPMIC
IX-SS-2GT
IXW-MA
IX-SS-2G-N
IX-RS-WT
IX-BU
IX-RS-W
IX-SSA-RA
IX-RS-BT
IX-SSA-2RA
IX-RS-B
IXGW-GW
IX-MV
IX-MV7-HB
IXG-SupportTool
IX-MV7-HBT
IX-SupportTool
IX-MV7-HW
IX-MV7-HWT
IXGW-LC
IX-MV7-HW-JP
IX-MV7-B
IXGW-TGW
IX-MV7-BT
IX-MV7-W
IX-MV7-WT
IX-DA
IX-EAT
IXG-DM7-HIDA
IX-EA
IX-DBT
IXG-DM7-10K
IX-DB
IX-DAU
IXG-MK

Install updates from vendor's website.

IX-EAU - update to 8.00
IX-DV - update to 8.00
IX-DVT - update to 8.00
IXG-DM7 - update to 4.00
IX-DVF - update to 8.00
IX-DVF-P - update to 8.00
IXG-2C7-L - update to 4.00
IXG-DM7-HID - update to 4.00
IX-FA - update to 8.00
IX-SSA - update to 8.00
IXG-2C7 - update to 4.00
IX-SS-2G - update to 8.00
IX-SPMIC - update to 8.00
IX-SS-2GT - update to 8.00
IXW-MA - update to 8.00
IX-SS-2G-N - update to 8.00
IX-RS-WT - update to 8.00
IX-BU - update to 8.00
IX-RS-W - update to 8.00
IX-SSA-RA - update to 8.00
IX-RS-BT - update to 8.00
IX-SSA-2RA - update to 8.00
IX-RS-B - update to 8.00
IXGW-GW - update to 4.00
IX-MV - update to 8.00
IX-MV7-HB - update to 8.00
IXG-SupportTool - update to 6.0.0.0
IX-MV7-HBT - update to 8.00
IX-SupportTool - update to 11.0.0.0
IX-MV7-HW - update to 8.00
IX-MV7-HWT - update to 8.00
IXGW-LC - update to 4.00
IX-MV7-HW-JP - update to 8.00
IX-MV7-B - update to 8.00
IXGW-TGW - update to 4.00
IX-MV7-BT - update to 8.00
IX-MV7-W - update to 8.00
IX-MV7-WT - update to 8.00
IX-DA - update to 8.00
IX-EAT - update to 8.00
IXG-DM7-HIDA - update to 4.00
IX-EA - update to 8.00
IX-DBT - update to 8.00
IXG-DM7-10K - update to 4.00
IX-DB - update to 8.00
IX-DAU - update to 8.00
IXG-MK - update to 4.00

• https://jvn.jp/en/jp/JVN41397971/index.html

• Multiple vulnerabilities in AIPHONE IX SYSTEM, IXG SYSTEM and System Support Software