Vulnerability-Lookup

CVE-2024-47142 (GCVE-0-2024-47142)

Vulnerability from cvelistv5 – Published: 2024-11-22 00:14 – Updated: 2024-11-22 11:34

Summary

AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials, which may allow a network-adjacent authenticated attacker to perform unintended operations.

Severity

5.5 (Medium)


                        
                          CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-22 11:29 UTC

CWE

CWE-522 - Insufficiently protected credentials

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 178 records in the last 180 days details

References

3 references

URL	Tags
https://www.aiphone.net/important/20241016_2/
https://www.aiphone.net/support/software-documents/ixg/
https://jvn.jp/en/jp/JVN41397971/

Impacted products

2 products

Vendor	Product	Version	CPE status
AIPHONE CO., LTD.	IXG-2C7	Affected: firmware Ver.2.03 and earlier	guessed
AIPHONE CO., LTD.	IXG-2C7-L	Affected: firmware Ver.2.03 and earlier	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47142",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-22T11:29:13.255927Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-22T11:34:09.326Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "IXG-2C7",
          "vendor": "AIPHONE CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware Ver.2.03 and earlier"
            }
          ]
        },
        {
          "product": "IXG-2C7-L",
          "vendor": "AIPHONE CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware Ver.2.03 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials, which may allow a network-adjacent authenticated attacker to perform unintended operations."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "Insufficiently protected credentials",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-22T00:14:03.529Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.aiphone.net/important/20241016_2/"
        },
        {
          "url": "https://www.aiphone.net/support/software-documents/ixg/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN41397971/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-47142",
    "datePublished": "2024-11-22T00:14:03.529Z",
    "dateReserved": "2024-09-26T01:39:40.760Z",
    "dateUpdated": "2024-11-22T11:34:09.326Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47142",
      "date": "2026-10-17",
      "epss": "0.00262",
      "percentile": "0.16831"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "IXG-2C7",
                "vendor": "AIPHONE CO., LTD.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "firmware Ver.2.03 and earlier"
                  }
                ]
              },
              {
                "product": "IXG-2C7-L",
                "vendor": "AIPHONE CO., LTD.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "firmware Ver.2.03 and earlier"
                  }
                ]
              }
            ],
            "source": "vultures@jpcert.or.jp"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials, which may allow a network-adjacent authenticated attacker to perform unintended operations."
          },
          {
            "lang": "es",
            "value": "El firmware AIPHONE IXG SYSTEM IXG-2C7, versi\u00f3n 2.03 y anteriores, y el firmware IXG-2C7-L, versi\u00f3n 2.03 y anteriores, contienen un problema con credenciales insuficientemente protegidas, lo que puede permitir que un atacante autenticado adyacente a la red realice operaciones no deseadas."
          }
        ],
        "id": "CVE-2024-47142",
        "lastModified": "2026-06-17T07:56:37.203",
        "metrics": {
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.0"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 3.4,
              "source": "vultures@jpcert.or.jp",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-47142",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-22T11:29:13.255927Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-11-22T02:15:21.280",
        "references": [
          {
            "source": "vultures@jpcert.or.jp",
            "url": "https://jvn.jp/en/jp/JVN41397971/"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "url": "https://www.aiphone.net/important/20241016_2/"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "url": "https://www.aiphone.net/support/software-documents/ixg/"
          }
        ],
        "sourceIdentifier": "vultures@jpcert.or.jp",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-522"
              }
            ],
            "source": "vultures@jpcert.or.jp",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T18:37:34+00:00",
      "cve": "CVE-2024-47142",
      "id": "CVE-2024-47142",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-47142",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47142.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-47142",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-11-22T11:29:13.255927Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-11-22T11:29:14.411Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "IXG-2C7",
              "vendor": "AIPHONE CO., LTD.",
              "versions": [
                {
                  "status": "affected",
                  "version": "firmware Ver.2.03 and earlier"
                }
              ]
            },
            {
              "product": "IXG-2C7-L",
              "vendor": "AIPHONE CO., LTD.",
              "versions": [
                {
                  "status": "affected",
                  "version": "firmware Ver.2.03 and earlier"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials, which may allow a network-adjacent authenticated attacker to perform unintended operations."
            }
          ],
          "metrics": [
            {
              "cvssV3_0": {
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.0"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en-US",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-522",
                  "description": "Insufficiently protected credentials",
                  "lang": "en-US",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-11-22T00:14:03.529Z",
            "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
            "shortName": "jpcert"
          },
          "references": [
            {
              "url": "https://www.aiphone.net/important/20241016_2/"
            },
            {
              "url": "https://www.aiphone.net/support/software-documents/ixg/"
            },
            {
              "url": "https://jvn.jp/en/jp/JVN41397971/"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "assignerShortName": "jpcert",
        "cveId": "CVE-2024-47142",
        "datePublished": "2024-11-22T00:14:03.529Z",
        "dateReserved": "2024-09-26T01:39:40.760Z",
        "dateUpdated": "2024-11-22T11:34:09.326Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-47142

Vulnerability from fkie_nvd - Published: 2024-11-22 02:15 - Updated: 2026-06-17 07:56

Severity

5.5 (Medium) - CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

References

	URL	Tags
	vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN41397971/
	vultures@jpcert.or.jp	https://www.aiphone.net/important/20241016_2/
	vultures@jpcert.or.jp	https://www.aiphone.net/support/software-documents/ixg/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "IXG-2C7",
          "vendor": "AIPHONE CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware Ver.2.03 and earlier"
            }
          ]
        },
        {
          "product": "IXG-2C7-L",
          "vendor": "AIPHONE CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware Ver.2.03 and earlier"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials, which may allow a network-adjacent authenticated attacker to perform unintended operations."
    },
    {
      "lang": "es",
      "value": "El firmware AIPHONE IXG SYSTEM IXG-2C7, versi\u00f3n 2.03 y anteriores, y el firmware IXG-2C7-L, versi\u00f3n 2.03 y anteriores, contienen un problema con credenciales insuficientemente protegidas, lo que puede permitir que un atacante autenticado adyacente a la red realice operaciones no deseadas."
    }
  ],
  "id": "CVE-2024-47142",
  "lastModified": "2026-06-17T07:56:37.203",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.4,
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47142",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-11-22T11:29:13.255927Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-11-22T02:15:21.280",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/jp/JVN41397971/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.aiphone.net/important/20241016_2/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://www.aiphone.net/support/software-documents/ixg/"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ],
      "source": "vultures@jpcert.or.jp",
      "type": "Secondary"
    }
  ]
}

GHSA-6245-P6W7-HF5M

Vulnerability from github – Published: 2024-11-22 04:25 – Updated: 2024-11-22 04:25

Details

Severity

5.5 (Medium)


                  
                    CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-47142"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-22T02:15:21Z",
    "severity": "MODERATE"
  },
  "details": "AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials, which may allow a network-adjacent authenticated attacker to perform unintended operations.",
  "id": "GHSA-6245-p6w7-hf5m",
  "modified": "2024-11-22T04:25:03Z",
  "published": "2024-11-22T04:25:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47142"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN41397971"
    },
    {
      "type": "WEB",
      "url": "https://www.aiphone.net/important/20241016_2"
    },
    {
      "type": "WEB",
      "url": "https://www.aiphone.net/support/software-documents/ixg"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

JVNDB-2024-000106

Vulnerability from jvndb - Published: 2024-10-21 02:58 - Updated:2024-11-21 02:37

Severity

8.0 (High) - cvssV3_0 - CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple vulnerabilities in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software

Details

AIPHONE IX SYSTEM is an IP Network Audio-Video Intercom and IXG SYSTEM is an IP-based Residential System. IX SYSTEM, IXG SYSTEM, and System Support Software contain multiple vulnerabilities listed below.

OS command injection (CWE-78) - CVE-2024-31408
Insufficiently protected credentials (CWE-522) - CVE-2024-39290
Use of hard-coded cryptographic key (CWE-321) - CVE-2024-45837
Improper access control (CWE-522) - CVE-2024-47142

Vera Mens of Claroty Research - Team82 reported these vulnerabilities to AIPHONE CO., LTD. and coordinated. After the coordination was completed, AIPHONE CO., LTD. reported this case to IPA to notify users of the solution through JVN. JPCERT/CC coordinated with the developer for the publication.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN41397971/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-31408
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-39290
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-45837
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-47142
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	AIPHONE CO., LTD.	IX-SupportTool
	AIPHONE CO., LTD.	IXG-SupportTool
	AIPHONE CO., LTD.	IX-BAU
	AIPHONE CO., LTD.	IX-BA
	AIPHONE CO., LTD.	IX-BBT
	AIPHONE CO., LTD.	IX-BB
	AIPHONE CO., LTD.	IX-BU
	AIPHONE CO., LTD.	IX-DAU
	AIPHONE CO., LTD.	IX-DA
	AIPHONE CO., LTD.	IX-DBT
	AIPHONE CO., LTD.	IX-DB
	AIPHONE CO., LTD.	IX-DU
	AIPHONE CO., LTD.	IX-DVF-2RA
	AIPHONE CO., LTD.	IX-DVF-L
	AIPHONE CO., LTD.	IX-DVF-P
	AIPHONE CO., LTD.	IX-DVF-RA
	AIPHONE CO., LTD.	IX-DVF
	AIPHONE CO., LTD.	IX-DVM
	AIPHONE CO., LTD.	IX-DVT
	AIPHONE CO., LTD.	IX-DV
	AIPHONE CO., LTD.	IX-EAT
	AIPHONE CO., LTD.	IX-EAU
	AIPHONE CO., LTD.	IX-EA
	AIPHONE CO., LTD.	IX-FA
	AIPHONE CO., LTD.	IX-MV7-BT
	AIPHONE CO., LTD.	IX-MV7-B
	AIPHONE CO., LTD.	IX-MV7-HBT
	AIPHONE CO., LTD.	IX-MV7-HB
	AIPHONE CO., LTD.	IX-MV7-HW-JP
	AIPHONE CO., LTD.	IX-MV7-HWT
	AIPHONE CO., LTD.	IX-MV7-HW
	AIPHONE CO., LTD.	IX-MV7-WT
	AIPHONE CO., LTD.	IX-MV7-W
	AIPHONE CO., LTD.	IX-MV
	AIPHONE CO., LTD.	IX-RS-BT
	AIPHONE CO., LTD.	IX-RS-B
	AIPHONE CO., LTD.	IX-RS-WT
	AIPHONE CO., LTD.	IX-RS-W
	AIPHONE CO., LTD.	IX-SPMIC
	AIPHONE CO., LTD.	IX-SS-2G-N
	AIPHONE CO., LTD.	IX-SS-2GT
	AIPHONE CO., LTD.	IX-SS-2G
	AIPHONE CO., LTD.	IX-SSA-2RA
	AIPHONE CO., LTD.	IX-SSA-RA
	AIPHONE CO., LTD.	IX-SSA
	AIPHONE CO., LTD.	IXG-2C7-L
	AIPHONE CO., LTD.	IXG-2C7
	AIPHONE CO., LTD.	IXG-DM7-10K
	AIPHONE CO., LTD.	IXG-DM7-HIDA
	AIPHONE CO., LTD.	IXG-DM7-HID
	AIPHONE CO., LTD.	IXG-DM7
	AIPHONE CO., LTD.	IXG-MK
	AIPHONE CO., LTD.	IXGW-GW
	AIPHONE CO., LTD.	IXGW-LC
	AIPHONE CO., LTD.	IXGW-TGW
	AIPHONE CO., LTD.	IXW-MA

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000106.html",
  "dc:date": "2024-11-21T11:37+09:00",
  "dcterms:issued": "2024-10-21T11:58+09:00",
  "dcterms:modified": "2024-11-21T11:37+09:00",
  "description": "AIPHONE IX SYSTEM is an IP Network Audio-Video Intercom and IXG SYSTEM is an IP-based Residential System.\r\nIX SYSTEM, IXG SYSTEM, and System Support Software contain multiple vulnerabilities listed below.\r\n\r\n\u003cul\u003e\r\n\t\u003cli\u003e\u003cb\u003eOS command injection (CWE-78)\u003c/b\u003e - CVE-2024-31408\u003c/li\u003e\r\n\t\u003cli\u003e\u003cb\u003eInsufficiently protected credentials (CWE-522)\u003c/b\u003e - CVE-2024-39290\u003c/li\u003e\r\n\t\u003cli\u003e\u003cb\u003eUse of hard-coded cryptographic key (CWE-321)\u003c/b\u003e - CVE-2024-45837\u003c/li\u003e\r\n\t\u003cli\u003e\u003cb\u003eImproper access control (CWE-522)\u003c/b\u003e - CVE-2024-47142\u003c/li\u003e\r\n\u003c/ul\u003e\r\n\r\nVera Mens of Claroty Research - Team82 reported these vulnerabilities to AIPHONE CO., LTD. and coordinated.\r\nAfter the coordination was completed, AIPHONE CO., LTD. reported this case to IPA to notify users of the solution through JVN. JPCERT/CC coordinated with the developer for the publication.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000106.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:aiphone:ix-supporttool",
      "@product": "IX-SupportTool",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:aiphone:ixg-supporttool",
      "@product": "IXG-SupportTool",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-bau_firmware",
      "@product": "IX-BAU",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-ba_firmware",
      "@product": "IX-BA",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-bbt_firmware",
      "@product": "IX-BBT",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-bb_firmware",
      "@product": "IX-BB",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-bu_firmware",
      "@product": "IX-BU",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-dau_firmware",
      "@product": "IX-DAU",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-da_firmware",
      "@product": "IX-DA",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-dbt_firmware",
      "@product": "IX-DBT",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-db_firmware",
      "@product": "IX-DB",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-du_firmware",
      "@product": "IX-DU",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-dvf-2ra_firmware",
      "@product": "IX-DVF-2RA",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-dvf-l_firmware",
      "@product": "IX-DVF-L",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-dvf-p_firmware",
      "@product": "IX-DVF-P",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-dvf-ra_firmware",
      "@product": "IX-DVF-RA",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-dvf_firmware",
      "@product": "IX-DVF",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-dvm_firmware",
      "@product": "IX-DVM",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-dvt_firmware",
      "@product": "IX-DVT",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-dv_firmware",
      "@product": "IX-DV",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-eat_firmware",
      "@product": "IX-EAT",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-eau_firmware",
      "@product": "IX-EAU",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-ea_firmware",
      "@product": "IX-EA",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-fa_firmware",
      "@product": "IX-FA",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-mv7-bt_firmware",
      "@product": "IX-MV7-BT",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-mv7-b_firmware",
      "@product": "IX-MV7-B",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-mv7-hbt_firmware",
      "@product": "IX-MV7-HBT",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-mv7-hb_firmware",
      "@product": "IX-MV7-HB",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-mv7-hw-jp_firmware",
      "@product": "IX-MV7-HW-JP",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-mv7-hwt_firmware",
      "@product": "IX-MV7-HWT",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-mv7-hw_firmware",
      "@product": "IX-MV7-HW",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-mv7-wt_firmware",
      "@product": "IX-MV7-WT",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-mv7-w_firmware",
      "@product": "IX-MV7-W",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-mv_firmware",
      "@product": "IX-MV",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-rs-bt_firmware",
      "@product": "IX-RS-BT",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-rs-b_firmware",
      "@product": "IX-RS-B",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-rs-wt_firmware",
      "@product": "IX-RS-WT",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-rs-w_firmware",
      "@product": "IX-RS-W",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-spmic_firmware",
      "@product": "IX-SPMIC",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-ss-2g-n_firmware",
      "@product": "IX-SS-2G-N",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-ss-2gt_firmware",
      "@product": "IX-SS-2GT",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-ss-2g_firmware",
      "@product": "IX-SS-2G",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-ssa-2ra_firmware",
      "@product": "IX-SSA-2RA",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-ssa-ra_firmware",
      "@product": "IX-SSA-RA",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ix-ssa_firmware",
      "@product": "IX-SSA",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ixg-2c7-l_firmware",
      "@product": "IXG-2C7-L",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ixg-2c7_firmware",
      "@product": "IXG-2C7",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ixg-dm7-10k_firmware",
      "@product": "IXG-DM7-10K",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ixg-dm7-hida_firmware",
      "@product": "IXG-DM7-HIDA",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ixg-dm7-hid_firmware",
      "@product": "IXG-DM7-HID",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ixg-dm7_firmware",
      "@product": "IXG-DM7",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ixg-mk_firmware",
      "@product": "IXG-MK",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ixgw-gw_firmware",
      "@product": "IXGW-GW",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ixgw-lc_firmware",
      "@product": "IXGW-LC",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ixgw-tgw_firmware",
      "@product": "IXGW-TGW",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:aiphone:ixw-ma_firmware",
      "@product": "IXW-MA",
      "@vendor": "AIPHONE CO., LTD.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "8.0",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000106",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN41397971/index.html",
      "@id": "JVN#41397971",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-31408",
      "@id": "CVE-2024-31408",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-39290",
      "@id": "CVE-2024-39290",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-45837",
      "@id": "CVE-2024-45837",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-47142",
      "@id": "CVE-2024-47142",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-47142 (GCVE-0-2024-47142)

FKIE_CVE-2024-47142

GHSA-6245-P6W7-HF5M

JVNDB-2024-000106

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour