CVE-2024-24781

Hima: Uncontrolled Resource Consumption in multiple products

Published Feb 13, 2024 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive traffic on a single ethernet port.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

HIMA

F30 03X YY (COM)

unaffected

Version	Status	Constraints
`0`	affected	≤ 24.14

HIMA

F30 03X YY (CPU)

unaffected

Version	Status	Constraints
`0`	affected	≤ 18.6

HIMA

F35 03X YY (COM)

unaffected

Version	Status	Constraints
`0`	affected	≤ 24.14

HIMA

F35 03X YY (CPU)

unaffected

Version	Status	Constraints
`0`	affected	≤ 18.6

HIMA

F60 CPU 03X YY (COM)

unaffected

Version	Status	Constraints
`0`	affected	≤ 24.14

HIMA

F60 CPU 03X YY (CPU)

unaffected

Version	Status	Constraints
`0`	affected	≤ 18.6

HIMA

F-COM 01

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.12

HIMA

F-COM 01 coated

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.12

HIMA

F-CPU 01

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.6

HIMA

F-CPU 01 coated

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.6

HIMA

X-COM 01 E YY

unaffected

Version	Status	Constraints
`0`	affected	≤ 15.14

HIMA

X-COM 01 YY

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.12

HIMA

X-CPU 01

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.6

HIMA

X-CPU 31

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.6

HIMA

X-SB 01

unaffected

Version	Status	Constraints
`0`	affected	≤ 7.54

Configuration 1 [-]

AND

cpe:2.3:o:hima:f30_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f30_03x_yy_\(com\):-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:hima:f30_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f30_03x_\(cpu\)_yy:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:hima:f35_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f35_03x_yy_\(com\)_:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:hima:f35_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f35_03x_yy_\(cpu\):-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:hima:f60_cpu_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f60_cpu_03x_yy_\(com\):-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:hima:f60_cpu_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f60_cpu_03x_yy_\(cpu\):-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:hima:f-com_01_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f-com_01:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:hima:f-cpu_01_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f-cpu_01:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:hima:x-com_01_e_yy_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:x-com_01_e_yy:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:hima:x-com_01_yy_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:x-com_01_yy:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:hima:x-cpu_01_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:x-cpu_01:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:hima:x-cpu_31_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:x-cpu_31:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:hima:x-sb_01_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:x-sb_01:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2024-22159	An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive traffic on a single ethernet port.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.718% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2024-013

History

Nov 7, 2024 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 18, 2024 7:30 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Hima Hima f-com 01 Hima f-com 01 Firmware Hima f-cpu 01 Hima f-cpu 01 Firmware Hima f30 03x \(cpu\) Yy Hima f30 03x Yy \(com\) Hima f30 03x Yy \(com\) Firmware Hima f30 03x Yy \(cpu\) Firmware Hima f35 03x Yy \(com\) Hima f35 03x Yy \(com\) Firmware Hima f35 03x Yy \(cpu\) Hima f35 03x Yy \(cpu\) Firmware Hima f60 Cpu 03x Yy \(com\) Hima f60 Cpu 03x Yy \(com\) Firmware Hima f60 Cpu 03x Yy \(cpu\) Hima f60 Cpu 03x Yy \(cpu\) Firmware Hima x-com 01 E Yy Hima x-com 01 E Yy Firmware Hima x-com 01 Yy Hima x-com 01 Yy Firmware Hima x-cpu 01 Hima x-cpu 01 Firmware Hima x-cpu 31 Hima x-cpu 31 Firmware Hima x-sb 01 Hima x-sb 01 Firmware
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:h:hima:f-com_01:-:::::::* cpe:2.3:h:hima:f-cpu_01:-:::::::* cpe:2.3:h:hima:f30_03x_\(cpu\)_yy:-:::::::* cpe:2.3:h:hima:f30_03x_yy_\(com\):-:::::::* cpe:2.3:h:hima:f35_03x_yy_\(com\)_:-:::::::* cpe:2.3:h:hima:f35_03x_yy_\(cpu\):-:::::::* cpe:2.3:h:hima:f60_cpu_03x_yy_\(com\):-:::::::* cpe:2.3:h:hima:f60_cpu_03x_yy_\(cpu\):-:::::::* cpe:2.3:h:hima:x-com_01_e_yy:-:::::::* cpe:2.3:h:hima:x-com_01_yy:-:::::::* cpe:2.3:h:hima:x-cpu_01:-:::::::* cpe:2.3:h:hima:x-cpu_31:-:::::::* cpe:2.3:h:hima:x-sb_01:-:::::::* cpe:2.3:o:hima:f-com_01_firmware:::::::: cpe:2.3:o:hima:f-cpu_01_firmware:::::::: cpe:2.3:o:hima:f30_03x_yy_\(com\)_firmware:::::::: cpe:2.3:o:hima:f30_03x_yy_\(cpu\)_firmware:::::::: cpe:2.3:o:hima:f35_03x_yy_\(com\)_firmware:::::::: cpe:2.3:o:hima:f35_03x_yy_\(cpu\)_firmware:::::::: cpe:2.3:o:hima:f60_cpu_03x_yy_\(com\)_firmware:::::::: cpe:2.3:o:hima:f60_cpu_03x_yy_\(cpu\)_firmware:::::::: cpe:2.3:o:hima:x-com_01_e_yy_firmware:::::::: cpe:2.3:o:hima:x-com_01_yy_firmware:::::::: cpe:2.3:o:hima:x-cpu_01_firmware:::::::: cpe:2.3:o:hima:x-cpu_31_firmware:::::::: cpe:2.3:o:hima:x-sb_01_firmware::::::::
Vendors & Products		Hima Hima f-com 01 Hima f-com 01 Firmware Hima f-cpu 01 Hima f-cpu 01 Firmware Hima f30 03x \(cpu\) Yy Hima f30 03x Yy \(com\) Hima f30 03x Yy \(com\) Firmware Hima f30 03x Yy \(cpu\) Firmware Hima f35 03x Yy \(com\) Hima f35 03x Yy \(com\) Firmware Hima f35 03x Yy \(cpu\) Hima f35 03x Yy \(cpu\) Firmware Hima f60 Cpu 03x Yy \(com\) Hima f60 Cpu 03x Yy \(com\) Firmware Hima f60 Cpu 03x Yy \(cpu\) Hima f60 Cpu 03x Yy \(cpu\) Firmware Hima x-com 01 E Yy Hima x-com 01 E Yy Firmware Hima x-com 01 Yy Hima x-com 01 Yy Firmware Hima x-cpu 01 Hima x-cpu 01 Firmware Hima x-cpu 31 Hima x-cpu 31 Firmware Hima x-sb 01 Hima x-sb 01 Firmware

Subscriptions

Hima F-com 01 F-com 01 Firmware F-cpu 01 F-cpu 01 Firmware F30 03x \(cpu\) Yy F30 03x Yy \(com\) F30 03x Yy \(com\) Firmware F30 03x Yy \(cpu\) Firmware F35 03x Yy \(com\) F35 03x Yy \(com\) Firmware F35 03x Yy \(cpu\) F35 03x Yy \(cpu\) Firmware F60 Cpu 03x Yy \(com\) F60 Cpu 03x Yy \(com\) Firmware F60 Cpu 03x Yy \(cpu\) F60 Cpu 03x Yy \(cpu\) Firmware X-com 01 E Yy X-com 01 E Yy Firmware X-com 01 Yy X-com 01 Yy Firmware X-cpu 01 X-cpu 01 Firmware X-cpu 31 X-cpu 31 Firmware X-sb 01 X-sb 01 Firmware

Weaknesses