Vulnerability-Lookup

CVE-2024-41929 (GCVE-0-2024-41929)

Vulnerability from cvelistv5 – Published: 2024-09-18 06:07 – Updated: 2024-09-18 15:23

Summary

Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

Improper authentication
CWE-287 - Improper Authentication

Assigner

jpcert

References

2 references

URL	Tags
https://www.takex-eng.co.jp/ja/news/news.php?s=68
https://jvn.jp/en/vu/JVNVU90142679/

Impacted products

18 products

Vendor	Product	Version
TAKENAKA ENGINEERING CO., LTD.	HDVR-400	Affected: prior to 46110.1.100869.65
TAKENAKA ENGINEERING CO., LTD.	HDVR-800	Affected: prior to 53210.1.900103.65
TAKENAKA ENGINEERING CO., LTD.	HDVR-1600	Affected: prior to 53310.1.900111.65
TAKENAKA ENGINEERING CO., LTD.	AHD04T-A	Affected: prior to 7xx10.1.900055.65
TAKENAKA ENGINEERING CO., LTD.	AHD08T-A	Affected: prior to 7xx10.1.900055.65
TAKENAKA ENGINEERING CO., LTD.	AHD16T-A	Affected: prior to 7xx10.1.900055.65
TAKENAKA ENGINEERING CO., LTD.	NVR04T-A	Affected: prior to 56x10.1.100540.65
TAKENAKA ENGINEERING CO., LTD.	NVR08T-A	Affected: prior to 56x10.1.100540.65
TAKENAKA ENGINEERING CO., LTD.	NVR16T-A	Affected: prior to 49310.1.100540.65
takenaka_engineering	hdvr-400_firmware	Affected: 0 , < 46110.1.100869.65 (custom) cpe:2.3:o:takenaka_engineering:hdvr-400_firmware::::::::
takenaka_engineering	hdvr-800_firmware	Affected: 0 , < 53210.1.900103.65 (custom) cpe:2.3:o:takenaka_engineering:hdvr-800_firmware::::::::
takenaka_engineering	hdvr-1600_firmware	Affected: 0 , < 53310.1.900111.65 (custom) cpe:2.3:o:takenaka_engineering:hdvr-1600_firmware::::::::
takenaka_engineering	ahd04t-a_firmware	Affected: 0 , < 7xx10.1.900055.65 (custom) cpe:2.3:o:takenaka_engineering:ahd04t-a_firmware::::::::
takenaka_engineering	ahd08t-a_firmware	Affected: 0 , < 7xx10.1.900055.65 (custom) cpe:2.3:o:takenaka_engineering:ahd08t-a_firmware::::::::
takenaka_engineering	ahd16t-a_firmware	Affected: 0 , < 7xx10.1.900055.65 (custom) cpe:2.3:o:takenaka_engineering:ahd16t-a_firmware::::::::
takenaka_engineering	nvr04t-a_firmware	Affected: 0 , < 56x10.1.100540.65 (custom) cpe:2.3:o:takenaka_engineering:nvr04t-a_firmware::::::::
takenaka_engineering	nvr08t-a_firmware	Affected: 0 , < 56x10.1.100540.65 (custom) cpe:2.3:o:takenaka_engineering:nvr08t-a_firmware::::::::
takenaka_engineering	nvr16t-a_firmware	Affected: 0 , < 49310.1.100540.65 (custom) cpe:2.3:o:takenaka_engineering:nvr16t-a_firmware::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:takenaka_engineering:hdvr-400_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "hdvr-400_firmware",
            "vendor": "takenaka_engineering",
            "versions": [
              {
                "lessThan": "46110.1.100869.65",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:takenaka_engineering:hdvr-800_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "hdvr-800_firmware",
            "vendor": "takenaka_engineering",
            "versions": [
              {
                "lessThan": "53210.1.900103.65",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:takenaka_engineering:hdvr-1600_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "hdvr-1600_firmware",
            "vendor": "takenaka_engineering",
            "versions": [
              {
                "lessThan": "53310.1.900111.65",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:takenaka_engineering:ahd04t-a_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ahd04t-a_firmware",
            "vendor": "takenaka_engineering",
            "versions": [
              {
                "lessThan": "7xx10.1.900055.65",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:takenaka_engineering:ahd08t-a_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ahd08t-a_firmware",
            "vendor": "takenaka_engineering",
            "versions": [
              {
                "lessThan": "7xx10.1.900055.65",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:takenaka_engineering:ahd16t-a_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ahd16t-a_firmware",
            "vendor": "takenaka_engineering",
            "versions": [
              {
                "lessThan": "7xx10.1.900055.65",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:takenaka_engineering:nvr04t-a_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nvr04t-a_firmware",
            "vendor": "takenaka_engineering",
            "versions": [
              {
                "lessThan": "56x10.1.100540.65",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:takenaka_engineering:nvr08t-a_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nvr08t-a_firmware",
            "vendor": "takenaka_engineering",
            "versions": [
              {
                "lessThan": "56x10.1.100540.65",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:takenaka_engineering:nvr16t-a_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nvr16t-a_firmware",
            "vendor": "takenaka_engineering",
            "versions": [
              {
                "lessThan": "49310.1.100540.65",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-41929",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-18T14:59:50.977866Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-287",
                "description": "CWE-287 Improper Authentication",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-18T15:23:55.272Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "HDVR-400",
          "vendor": "TAKENAKA ENGINEERING CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 46110.1.100869.65"
            }
          ]
        },
        {
          "product": "HDVR-800",
          "vendor": "TAKENAKA ENGINEERING CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 53210.1.900103.65"
            }
          ]
        },
        {
          "product": "HDVR-1600",
          "vendor": "TAKENAKA ENGINEERING CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 53310.1.900111.65"
            }
          ]
        },
        {
          "product": "AHD04T-A",
          "vendor": "TAKENAKA ENGINEERING CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 7xx10.1.900055.65"
            }
          ]
        },
        {
          "product": "AHD08T-A",
          "vendor": "TAKENAKA ENGINEERING CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 7xx10.1.900055.65"
            }
          ]
        },
        {
          "product": "AHD16T-A",
          "vendor": "TAKENAKA ENGINEERING CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 7xx10.1.900055.65"
            }
          ]
        },
        {
          "product": "NVR04T-A",
          "vendor": "TAKENAKA ENGINEERING CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 56x10.1.100540.65"
            }
          ]
        },
        {
          "product": "NVR08T-A",
          "vendor": "TAKENAKA ENGINEERING CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 56x10.1.100540.65"
            }
          ]
        },
        {
          "product": "NVR16T-A",
          "vendor": "TAKENAKA ENGINEERING CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 49310.1.100540.65"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper authentication",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-18T06:07:55.880Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.takex-eng.co.jp/ja/news/news.php?s=68"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU90142679/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-41929",
    "datePublished": "2024-09-18T06:07:55.880Z",
    "dateReserved": "2024-09-17T04:33:43.397Z",
    "dateUpdated": "2024-09-18T15:23:55.272Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-41929",
      "date": "2026-06-11",
      "epss": "0.02314",
      "percentile": "0.85127"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41929\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2024-09-18T07:15:02.847\",\"lastModified\":\"2024-09-20T12:30:51.220\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de autenticaci\u00f3n inadecuada en m\u00faltiples grabadoras de video digitales proporcionadas por TAKENAKA ENGINEERING CO., LTD. permite que un atacante autenticado remoto ejecute un comando de sistema operativo arbitrario en el dispositivo o altere la configuraci\u00f3n del dispositivo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"references\":[{\"url\":\"https://jvn.jp/en/vu/JVNVU90142679/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.takex-eng.co.jp/ja/news/news.php?s=68\",\"source\":\"vultures@jpcert.or.jp\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41929\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-18T14:59:50.977866Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:takenaka_engineering:hdvr-400_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"takenaka_engineering\", \"product\": \"hdvr-400_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"46110.1.100869.65\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:takenaka_engineering:hdvr-800_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"takenaka_engineering\", \"product\": \"hdvr-800_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"53210.1.900103.65\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:takenaka_engineering:hdvr-1600_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"takenaka_engineering\", \"product\": \"hdvr-1600_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"53310.1.900111.65\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:takenaka_engineering:ahd04t-a_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"takenaka_engineering\", \"product\": \"ahd04t-a_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"7xx10.1.900055.65\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:takenaka_engineering:ahd08t-a_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"takenaka_engineering\", \"product\": \"ahd08t-a_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"7xx10.1.900055.65\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:takenaka_engineering:ahd16t-a_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"takenaka_engineering\", \"product\": \"ahd16t-a_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"7xx10.1.900055.65\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:takenaka_engineering:nvr04t-a_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"takenaka_engineering\", \"product\": \"nvr04t-a_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"56x10.1.100540.65\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:takenaka_engineering:nvr08t-a_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"takenaka_engineering\", \"product\": \"nvr08t-a_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"56x10.1.100540.65\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:takenaka_engineering:nvr16t-a_firmware:*:*:*:*:*:*:*:*\"], \"vendor\": \"takenaka_engineering\", \"product\": \"nvr16t-a_firmware\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"49310.1.100540.65\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287 Improper Authentication\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-18T15:00:21.367Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"TAKENAKA ENGINEERING CO., LTD.\", \"product\": \"HDVR-400\", \"versions\": [{\"status\": \"affected\", \"version\": \"prior to 46110.1.100869.65\"}]}, {\"vendor\": \"TAKENAKA ENGINEERING CO., LTD.\", \"product\": \"HDVR-800\", \"versions\": [{\"status\": \"affected\", \"version\": \"prior to 53210.1.900103.65\"}]}, {\"vendor\": \"TAKENAKA ENGINEERING CO., LTD.\", \"product\": \"HDVR-1600\", \"versions\": [{\"status\": \"affected\", \"version\": \"prior to 53310.1.900111.65\"}]}, {\"vendor\": \"TAKENAKA ENGINEERING CO., LTD.\", \"product\": \"AHD04T-A\", \"versions\": [{\"status\": \"affected\", \"version\": \"prior to 7xx10.1.900055.65\"}]}, {\"vendor\": \"TAKENAKA ENGINEERING CO., LTD.\", \"product\": \"AHD08T-A\", \"versions\": [{\"status\": \"affected\", \"version\": \"prior to 7xx10.1.900055.65\"}]}, {\"vendor\": \"TAKENAKA ENGINEERING CO., LTD.\", \"product\": \"AHD16T-A\", \"versions\": [{\"status\": \"affected\", \"version\": \"prior to 7xx10.1.900055.65\"}]}, {\"vendor\": \"TAKENAKA ENGINEERING CO., LTD.\", \"product\": \"NVR04T-A\", \"versions\": [{\"status\": \"affected\", \"version\": \"prior to 56x10.1.100540.65\"}]}, {\"vendor\": \"TAKENAKA ENGINEERING CO., LTD.\", \"product\": \"NVR08T-A\", \"versions\": [{\"status\": \"affected\", \"version\": \"prior to 56x10.1.100540.65\"}]}, {\"vendor\": \"TAKENAKA ENGINEERING CO., LTD.\", \"product\": \"NVR16T-A\", \"versions\": [{\"status\": \"affected\", \"version\": \"prior to 49310.1.100540.65\"}]}], \"references\": [{\"url\": \"https://www.takex-eng.co.jp/ja/news/news.php?s=68\"}, {\"url\": \"https://jvn.jp/en/vu/JVNVU90142679/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Improper authentication\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2024-09-18T06:07:55.880Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41929\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-18T15:23:55.272Z\", \"dateReserved\": \"2024-09-17T04:33:43.397Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2024-09-18T06:07:55.880Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-41929

Vulnerability from fkie_nvd - Published: 2024-09-18 07:15 - Updated: 2026-04-15 00:35

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/vu/JVNVU90142679/
	vultures@jpcert.or.jp	https://www.takex-eng.co.jp/ja/news/news.php?s=68

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de autenticaci\u00f3n inadecuada en m\u00faltiples grabadoras de video digitales proporcionadas por TAKENAKA ENGINEERING CO., LTD. permite que un atacante autenticado remoto ejecute un comando de sistema operativo arbitrario en el dispositivo o altere la configuraci\u00f3n del dispositivo."
    }
  ],
  "id": "CVE-2024-41929",
  "lastModified": "2026-04-15T00:35:42.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-18T07:15:02.847",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/vu/JVNVU90142679/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.takex-eng.co.jp/ja/news/news.php?s=68"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-5P8V-M885-Q5FG

Vulnerability from github – Published: 2024-09-18 09:30 – Updated: 2024-09-18 18:30

Details

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-41929"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-18T07:15:02Z",
    "severity": "HIGH"
  },
  "details": "Improper authentication vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.",
  "id": "GHSA-5p8v-m885-q5fg",
  "modified": "2024-09-18T18:30:51Z",
  "published": "2024-09-18T09:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41929"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU90142679"
    },
    {
      "type": "WEB",
      "url": "https://www.takex-eng.co.jp/ja/news/news.php?s=68"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

JVNDB-2024-008391

Vulnerability from jvndb - Published: 2024-09-19 14:07 - Updated:2024-09-19 14:07

Severity

8.8 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple vulnerabilities in TAKENAKA ENGINEERING digital video recorders

Details

Multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. contain multiple vulnerabilities listed below.

Improper authentication (CWE-287) - CVE-2024-41929
OS command injection (CWE-78) - CVE-2024-43778
Hidden functionality (CWE-912) - CVE-2024-47001

Yoshiki Mori, Ushimaru Hayato, Yuki Umemura and Masaki Kubo of Cybersecurity Research Institute, National Institute of Information and Communications Technology reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU90142679/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-41929
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-43778
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-47001
	Improper Authentication(CWE-287)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Hidden Functionality(CWE-912)	https://cwe.mitre.org/data/definitions/912.html

Impacted products

Vendor

Product

	TAKENAKA ENGINEERING CO., LTD.	AHD04T-A
	TAKENAKA ENGINEERING CO., LTD.	AHD08T-A
	TAKENAKA ENGINEERING CO., LTD.	AHD16T-A
	TAKENAKA ENGINEERING CO., LTD.	HDVR-1600
	TAKENAKA ENGINEERING CO., LTD.	HDVR-400
	TAKENAKA ENGINEERING CO., LTD.	HDVR-800
	TAKENAKA ENGINEERING CO., LTD.	NVR04T-A
	TAKENAKA ENGINEERING CO., LTD.	NVR08T-A
	TAKENAKA ENGINEERING CO., LTD.	NVR16T-A

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-008391.html",
  "dc:date": "2024-09-19T14:07+09:00",
  "dcterms:issued": "2024-09-19T14:07+09:00",
  "dcterms:modified": "2024-09-19T14:07+09:00",
  "description": "Multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. contain multiple vulnerabilities listed below.\r\n\r\n\u003cul\u003e\r\n\u003cli\u003eImproper authentication (CWE-287) - CVE-2024-41929\u003c/li\u003e\r\n\u003cli\u003eOS command injection (CWE-78) - CVE-2024-43778\u003c/li\u003e\r\n\u003cli\u003eHidden functionality (CWE-912) - CVE-2024-47001\u003c/li\u003e\r\n\u003c/ul\u003e\r\n\r\nYoshiki Mori, Ushimaru Hayato, Yuki Umemura and Masaki Kubo of Cybersecurity Research Institute, National Institute of Information and Communications Technology reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-008391.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:misc:takenaka_engineering_ahd04t-a",
      "@product": "AHD04T-A",
      "@vendor": "TAKENAKA ENGINEERING CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:misc:takenaka_engineering_ahd08t-a",
      "@product": "AHD08T-A",
      "@vendor": "TAKENAKA ENGINEERING CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:misc:takenaka_engineering_ahd16t-a",
      "@product": "AHD16T-A",
      "@vendor": "TAKENAKA ENGINEERING CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:misc:takenaka_engineering_hdvr-1600",
      "@product": "HDVR-1600",
      "@vendor": "TAKENAKA ENGINEERING CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:misc:takenaka_engineering_hdvr-400",
      "@product": "HDVR-400",
      "@vendor": "TAKENAKA ENGINEERING CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:misc:takenaka_engineering_hdvr-800",
      "@product": "HDVR-800",
      "@vendor": "TAKENAKA ENGINEERING CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:misc:takenaka_engineering_nvr04t-a",
      "@product": "NVR04T-A",
      "@vendor": "TAKENAKA ENGINEERING CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:misc:takenaka_engineering_nvr08t-a",
      "@product": "NVR08T-A",
      "@vendor": "TAKENAKA ENGINEERING CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:misc:takenaka_engineering_nvr16t-a",
      "@product": "NVR16T-A",
      "@vendor": "TAKENAKA ENGINEERING CO., LTD.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "8.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-008391",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU90142679/index.html",
      "@id": "JVNVU#90142679",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-41929",
      "@id": "CVE-2024-41929",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-43778",
      "@id": "CVE-2024-43778",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-47001",
      "@id": "CVE-2024-47001",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-287",
      "@title": "Improper Authentication(CWE-287)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/912.html",
      "@id": "CWE-912",
      "@title": "Hidden Functionality(CWE-912)"
    }
  ],
  "title": "Multiple vulnerabilities in TAKENAKA ENGINEERING digital video recorders"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-41929 (GCVE-0-2024-41929)

FKIE_CVE-2024-41929

GHSA-5P8V-M885-Q5FG

JVNDB-2024-008391

Tags

Sightings

Nomenclature