CVE-2024-23978 - Vulnerability Details - OpenCVE

Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be executed. Note that the affected products are no longer supported.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Kddi	Home Spot Cube 2 Home Spot Cube 2 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:kddi:home_spot_cube_2_firmware:v102:*:*:*:*:*:*:*

cpe:2.3:h:kddi:home_spot_cube_2:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://jvn.jp/en/vu/JVNVU93740658/
https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/

History

Thu, 15 May 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-02-02T06:38:33.253Z

Updated: 2025-05-15T19:50:24.669Z

Reserved: 2024-01-25T01:46:40.762Z

Link: CVE-2024-23978

Vulnrichment

Updated: 2024-08-01T23:13:08.702Z

NVD

Status : Modified

Published: 2024-02-02T07:15:12.540

Modified: 2025-05-15T20:15:44.953

Link: CVE-2024-23978

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23978", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-01-25T01:46:40.762Z", "datePublished": "2024-02-02T06:38:33.253Z", "dateUpdated": "2025-05-15T19:50:24.669Z"}, "containers": {"cna": {"affected": [{"vendor": "KDDI CORPORATION", "product": "HOME SPOT CUBE2", "versions": [{"version": "V102 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be executed. Note that the affected products are no longer supported."}], "problemTypes": [{"descriptions": [{"description": "Heap-based buffer overflow", "lang": "en", "type": "text"}]}], "references": [{"url": "https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/"}, {"url": "https://jvn.jp/en/vu/JVNVU93740658/"}], "tags": ["unsupported-when-assigned"], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-02-02T06:38:33.253Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:13:08.702Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/vu/JVNVU93740658/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-09T23:33:59.064031Z", "id": "CVE-2024-23978", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-15T19:50:24.669Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/vu/JVNVU93740658/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:13:08.702Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-23978", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-09T23:33:59.064031Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-09T23:34:00.748Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "affected": [{"vendor": "KDDI CORPORATION", "product": "HOME SPOT CUBE2", "versions": [{"status": "affected", "version": "V102 and earlier"}]}], "references": [{"url": "https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/"}, {"url": "https://jvn.jp/en/vu/JVNVU93740658/"}], "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be executed. Note that the affected products are no longer supported."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Heap-based buffer overflow"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-02-02T06:38:33.253Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23978", "state": "PUBLISHED", "dateUpdated": "2025-05-15T19:50:24.669Z", "dateReserved": "2024-01-25T01:46:40.762Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-02-02T06:38:33.253Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:kddi:home_spot_cube_2_firmware:v102:*:*:*:*:*:*:*", "matchCriteriaId": "E65DAC1C-559C-4396-958C-8EC4A2552987", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:kddi:home_spot_cube_2:-:*:*:*:*:*:*:*", "matchCriteriaId": "330A6D16-3BBA-4D46-B7C1-17C08C8373D5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [{"sourceIdentifier": "vultures@jpcert.or.jp", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be executed. Note that the affected products are no longer supported."}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de b\u00fafer en la regi\u00f3n Heap de la memoria en HOME SPOT CUBE2 V102 y versiones anteriores. Al procesar valores no v\u00e1lidos, se puede ejecutar c\u00f3digo arbitrario. Tenga en cuenta que los productos afectados ya no son compatibles."}], "id": "CVE-2024-23978", "lastModified": "2025-05-15T20:15:44.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-02-02T07:15:12.540", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/vu/JVNVU93740658/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/vu/JVNVU93740658/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}