Multiple vulnerabilities in SHARP routers for SoftBank



Risk High
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2024-46873
CVE-2024-52321
CWE-ID CWE-489
CWE-497
Exploitation vector Network
Public exploit N/A
Vulnerable software
 PocketWifi 809SH
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor SoftBank

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Active Debug Code

EUVDB-ID: #VU101784

Risk: High

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-46873

CWE-ID: CWE-489 - Active Debug Code

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the hidden debug function is enabled. A remote attacker can execute arbitrary commands on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PocketWifi 809SH: 01.00.B9

CPE2.3 External links

http://k-tai.sharp.co.jp/support/info/info083.html
http://www.softbank.jp/mobile/info/personal/software/20241205-01/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Exposure of Sensitive System Information to an Unauthorized Control Sphere

EUVDB-ID: #VU101786

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-52321

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper authentication in the configuration backup function. A remote attacker can gain unauthorized access to sensitive information on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PocketWifi 809SH: 01.00.B9

CPE2.3 External links

http://k-tai.sharp.co.jp/support/info/info083.html
http://www.softbank.jp/mobile/info/personal/software/20241205-01/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###