CVE-2024-24782

HIMA: Origin Validation Error in multiple products

Published Feb 13, 2024 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

HIMA

F30 03X YY (COM)

unaffected

Version	Status	Constraints
`0`	affected	≤ 24.14

HIMA

F30 03X YY (CPU)

unaffected

Version	Status	Constraints
`0`	affected	≤ 18.6

HIMA

F35 03X YY (COM)

unaffected

Version	Status	Constraints
`0`	affected	≤ 24.14

HIMA

F35 03X YY (CPU)

unaffected

Version	Status	Constraints
`0`	affected	≤ 18.6

HIMA

F60 CPU 03X YY (COM)

unaffected

Version	Status	Constraints
`0`	affected	≤ 24.14

HIMA

F60 CPU 03X YY (CPU)

unaffected

Version	Status	Constraints
`0`	affected	≤ 18.6

HIMA

F-COM 01

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.12

HIMA

F-COM 01 coated

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.12

HIMA

F-CPU 01

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.6

HIMA

F-CPU 01 coated

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.6

HIMA

X-COM 01 E YY

unaffected

Version	Status	Constraints
`0`	affected	≤ 15.14

HIMA

X-COM 01 YY

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.12

HIMA

X-CPU 01

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.6

HIMA

X-CPU 31

unaffected

Version	Status	Constraints
`0`	affected	≤ 14.6

Configuration 1 [-]

AND

cpe:2.3:o:hima:f30_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f30_03x_yy_\(com\):-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:hima:f30_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f30_03x_\(cpu\)_yy:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:hima:f35_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f35_03x_yy_\(com\)_:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:hima:f35_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f35_03x_yy_\(cpu\):-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:hima:f60_cpu_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f60_cpu_03x_yy_\(com\):-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:hima:f60_cpu_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f60_cpu_03x_yy_\(cpu\):-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:hima:f-com_01_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f-com_01:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:hima:f-cpu_01_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:f-cpu_01:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:hima:x-com_01_e_yy_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:x-com_01_e_yy:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:hima:x-com_01_yy_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:x-com_01_yy:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:hima:x-cpu_01_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:x-cpu_01:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:hima:x-cpu_31_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:x-cpu_31:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:hima:x-sb_01_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hima:x-sb_01:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2024-22160	An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN.

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.161% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2024-013

History

May 8, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 18, 2024 7:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Hima Hima f-com 01 Hima f-com 01 Firmware Hima f-cpu 01 Hima f-cpu 01 Firmware Hima f30 03x \(cpu\) Yy Hima f30 03x Yy \(com\) Hima f30 03x Yy \(com\) Firmware Hima f30 03x Yy \(cpu\) Firmware Hima f35 03x Yy \(com\) Hima f35 03x Yy \(com\) Firmware Hima f35 03x Yy \(cpu\) Hima f35 03x Yy \(cpu\) Firmware Hima f60 Cpu 03x Yy \(com\) Hima f60 Cpu 03x Yy \(com\) Firmware Hima f60 Cpu 03x Yy \(cpu\) Hima f60 Cpu 03x Yy \(cpu\) Firmware Hima x-com 01 E Yy Hima x-com 01 E Yy Firmware Hima x-com 01 Yy Hima x-com 01 Yy Firmware Hima x-cpu 01 Hima x-cpu 01 Firmware Hima x-cpu 31 Hima x-cpu 31 Firmware Hima x-sb 01 Hima x-sb 01 Firmware
CPEs		cpe:2.3:h:hima:f-com_01:-:::::::* cpe:2.3:h:hima:f-cpu_01:-:::::::* cpe:2.3:h:hima:f30_03x_\(cpu\)_yy:-:::::::* cpe:2.3:h:hima:f30_03x_yy_\(com\):-:::::::* cpe:2.3:h:hima:f35_03x_yy_\(com\)_:-:::::::* cpe:2.3:h:hima:f35_03x_yy_\(cpu\):-:::::::* cpe:2.3:h:hima:f60_cpu_03x_yy_\(com\):-:::::::* cpe:2.3:h:hima:f60_cpu_03x_yy_\(cpu\):-:::::::* cpe:2.3:h:hima:x-com_01_e_yy:-:::::::* cpe:2.3:h:hima:x-com_01_yy:-:::::::* cpe:2.3:h:hima:x-cpu_01:-:::::::* cpe:2.3:h:hima:x-cpu_31:-:::::::* cpe:2.3:h:hima:x-sb_01:-:::::::* cpe:2.3:o:hima:f-com_01_firmware:::::::: cpe:2.3:o:hima:f-cpu_01_firmware:::::::: cpe:2.3:o:hima:f30_03x_yy_\(com\)_firmware:::::::: cpe:2.3:o:hima:f30_03x_yy_\(cpu\)_firmware:::::::: cpe:2.3:o:hima:f35_03x_yy_\(com\)_firmware:::::::: cpe:2.3:o:hima:f35_03x_yy_\(cpu\)_firmware:::::::: cpe:2.3:o:hima:f60_cpu_03x_yy_\(com\)_firmware:::::::: cpe:2.3:o:hima:f60_cpu_03x_yy_\(cpu\)_firmware:::::::: cpe:2.3:o:hima:x-com_01_e_yy_firmware:::::::: cpe:2.3:o:hima:x-com_01_yy_firmware:::::::: cpe:2.3:o:hima:x-cpu_01_firmware:::::::: cpe:2.3:o:hima:x-cpu_31_firmware:::::::: cpe:2.3:o:hima:x-sb_01_firmware::::::::
Vendors & Products		Hima Hima f-com 01 Hima f-com 01 Firmware Hima f-cpu 01 Hima f-cpu 01 Firmware Hima f30 03x \(cpu\) Yy Hima f30 03x Yy \(com\) Hima f30 03x Yy \(com\) Firmware Hima f30 03x Yy \(cpu\) Firmware Hima f35 03x Yy \(com\) Hima f35 03x Yy \(com\) Firmware Hima f35 03x Yy \(cpu\) Hima f35 03x Yy \(cpu\) Firmware Hima f60 Cpu 03x Yy \(com\) Hima f60 Cpu 03x Yy \(com\) Firmware Hima f60 Cpu 03x Yy \(cpu\) Hima f60 Cpu 03x Yy \(cpu\) Firmware Hima x-com 01 E Yy Hima x-com 01 E Yy Firmware Hima x-com 01 Yy Hima x-com 01 Yy Firmware Hima x-cpu 01 Hima x-cpu 01 Firmware Hima x-cpu 31 Hima x-cpu 31 Firmware Hima x-sb 01 Hima x-sb 01 Firmware

Subscriptions

Hima F-com 01 F-com 01 Firmware F-cpu 01 F-cpu 01 Firmware F30 03x \(cpu\) Yy F30 03x Yy \(com\) F30 03x Yy \(com\) Firmware F30 03x Yy \(cpu\) Firmware F35 03x Yy \(com\) F35 03x Yy \(com\) Firmware F35 03x Yy \(cpu\) F35 03x Yy \(cpu\) Firmware F60 Cpu 03x Yy \(com\) F60 Cpu 03x Yy \(com\) Firmware F60 Cpu 03x Yy \(cpu\) F60 Cpu 03x Yy \(cpu\) Firmware X-com 01 E Yy X-com 01 E Yy Firmware X-com 01 Yy X-com 01 Yy Firmware X-cpu 01 X-cpu 01 Firmware X-cpu 31 X-cpu 31 Firmware X-sb 01 X-sb 01 Firmware

Weaknesses