HIMA: Origin Validation Error in multiple products
Priority LOW 19CWE-346Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.
Summary
An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00161 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HIMA | F30 03X YY (COM) | up to 24.14 | — | No fix listed | CNA |
| HIMA | F30 03X YY (CPU) | up to 18.6 | — | No fix listed | CNA |
| HIMA | F35 03X YY (COM) | up to 24.14 | — | No fix listed | CNA |
| HIMA | F35 03X YY (CPU) | up to 18.6 | — | No fix listed | CNA |
| HIMA | F60 CPU 03X YY (COM) | up to 24.14 | — | No fix listed | CNA |
| HIMA | F60 CPU 03X YY (CPU) | up to 18.6 | — | No fix listed | CNA |
| HIMA | F-COM 01 | up to 14.12 | — | No fix listed | CNA |
| HIMA | F-COM 01 coated | up to 14.12 | — | No fix listed | CNA |
| HIMA | F-CPU 01 | up to 14.6 | — | No fix listed | CNA |
| HIMA | F-CPU 01 coated | up to 14.6 | — | No fix listed | CNA |
| HIMA | X-COM 01 E YY | up to 15.14 | — | No fix listed | CNA |
| HIMA | X-COM 01 YY | up to 14.12 | — | No fix listed | CNA |
| HIMA | X-CPU 01 | up to 14.6 | — | No fix listed | CNA |
| HIMA | X-CPU 31 | up to 14.6 | — | No fix listed | CNA |
- F30 03X YY (COM) VendorHIMA Affected up to 24.14 Fixed in — No fix listed CNA
- F30 03X YY (CPU) VendorHIMA Affected up to 18.6 Fixed in — No fix listed CNA
- F35 03X YY (COM) VendorHIMA Affected up to 24.14 Fixed in — No fix listed CNA
- F35 03X YY (CPU) VendorHIMA Affected up to 18.6 Fixed in — No fix listed CNA
- F60 CPU 03X YY (COM) VendorHIMA Affected up to 24.14 Fixed in — No fix listed CNA
- F60 CPU 03X YY (CPU) VendorHIMA Affected up to 18.6 Fixed in — No fix listed CNA
- F-COM 01 VendorHIMA Affected up to 14.12 Fixed in — No fix listed CNA
- F-COM 01 coated VendorHIMA Affected up to 14.12 Fixed in — No fix listed CNA
- F-CPU 01 VendorHIMA Affected up to 14.6 Fixed in — No fix listed CNA
- F-CPU 01 coated VendorHIMA Affected up to 14.6 Fixed in — No fix listed CNA
- X-COM 01 E YY VendorHIMA Affected up to 15.14 Fixed in — No fix listed CNA
- X-COM 01 YY VendorHIMA Affected up to 14.12 Fixed in — No fix listed CNA
- X-CPU 01 VendorHIMA Affected up to 14.6 Fixed in — No fix listed CNA
- X-CPU 31 VendorHIMA Affected up to 14.6 Fixed in — No fix listed CNA
CPE configurations NVD · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hima:f30_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:* | up to 24.14 | Vulnerable | HIMA |
| cpe:2.3:h:hima:f30_03x_yy_\(com\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
| cpe:2.3:o:hima:f30_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:* | up to 18.6 | Vulnerable | HIMA |
| cpe:2.3:h:hima:f30_03x_\(cpu\)_yy:-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
| cpe:2.3:o:hima:f35_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:* | up to 24.14 | Vulnerable | HIMA |
| cpe:2.3:h:hima:f35_03x_yy_\(com\)_:-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
| cpe:2.3:o:hima:f35_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:* | up to 18.6 | Vulnerable | HIMA |
| cpe:2.3:h:hima:f35_03x_yy_\(cpu\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
| cpe:2.3:o:hima:f60_cpu_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:* | up to 24.14 | Vulnerable | HIMA |
| cpe:2.3:h:hima:f60_cpu_03x_yy_\(com\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
- cpe:2.3:o:hima:f30_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:* Versions up to 24.14 Vulnerable ·HIMA
- cpe:2.3:h:hima:f30_03x_yy_\(com\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
- cpe:2.3:o:hima:f30_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:* Versions up to 18.6 Vulnerable ·HIMA
- cpe:2.3:h:hima:f30_03x_\(cpu\)_yy:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
- cpe:2.3:o:hima:f35_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:* Versions up to 24.14 Vulnerable ·HIMA
- cpe:2.3:h:hima:f35_03x_yy_\(com\)_:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
- cpe:2.3:o:hima:f35_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:* Versions up to 18.6 Vulnerable ·HIMA
- cpe:2.3:h:hima:f35_03x_yy_\(cpu\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
- cpe:2.3:o:hima:f60_cpu_03x_yy_\(com\)_firmware:*:*:*:*:*:*:*:* Versions up to 24.14 Vulnerable ·HIMA
- cpe:2.3:h:hima:f60_cpu_03x_yy_\(com\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hima:f60_cpu_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:* | up to 18.6 | Vulnerable | HIMA |
| cpe:2.3:h:hima:f60_cpu_03x_yy_\(cpu\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
| cpe:2.3:o:hima:f-com_01_firmware:*:*:*:*:*:*:*:* | up to 14.12 | Vulnerable | HIMA |
| cpe:2.3:h:hima:f-com_01:-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
| cpe:2.3:o:hima:f-cpu_01_firmware:*:*:*:*:*:*:*:* | up to 14.16 | Vulnerable | HIMA |
| cpe:2.3:h:hima:f-cpu_01:-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
| cpe:2.3:o:hima:x-com_01_e_yy_firmware:*:*:*:*:*:*:*:* | up to 15.14 | Vulnerable | HIMA |
| cpe:2.3:h:hima:x-com_01_e_yy:-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
| cpe:2.3:o:hima:x-com_01_yy_firmware:*:*:*:*:*:*:*:* | up to 14.12 | Vulnerable | HIMA |
| cpe:2.3:h:hima:x-com_01_yy:-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
| cpe:2.3:o:hima:x-cpu_01_firmware:*:*:*:*:*:*:*:* | up to 14.16 | Vulnerable | HIMA |
| cpe:2.3:h:hima:x-cpu_01:-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
| cpe:2.3:o:hima:x-cpu_31_firmware:*:*:*:*:*:*:*:* | up to 14.16 | Vulnerable | HIMA |
| cpe:2.3:h:hima:x-cpu_31:-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
| cpe:2.3:o:hima:x-sb_01_firmware:*:*:*:*:*:*:*:* | up to 7.54 | Vulnerable | HIMA |
| cpe:2.3:h:hima:x-sb_01:-:*:*:*:*:*:*:* | not specified by NVD | Running on | HIMA |
- cpe:2.3:o:hima:f60_cpu_03x_yy_\(cpu\)_firmware:*:*:*:*:*:*:*:* Versions up to 18.6 Vulnerable ·HIMA
- cpe:2.3:h:hima:f60_cpu_03x_yy_\(cpu\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
- cpe:2.3:o:hima:f-com_01_firmware:*:*:*:*:*:*:*:* Versions up to 14.12 Vulnerable ·HIMA
- cpe:2.3:h:hima:f-com_01:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
- cpe:2.3:o:hima:f-cpu_01_firmware:*:*:*:*:*:*:*:* Versions up to 14.16 Vulnerable ·HIMA
- cpe:2.3:h:hima:f-cpu_01:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
- cpe:2.3:o:hima:x-com_01_e_yy_firmware:*:*:*:*:*:*:*:* Versions up to 15.14 Vulnerable ·HIMA
- cpe:2.3:h:hima:x-com_01_e_yy:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
- cpe:2.3:o:hima:x-com_01_yy_firmware:*:*:*:*:*:*:*:* Versions up to 14.12 Vulnerable ·HIMA
- cpe:2.3:h:hima:x-com_01_yy:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
- cpe:2.3:o:hima:x-cpu_01_firmware:*:*:*:*:*:*:*:* Versions up to 14.16 Vulnerable ·HIMA
- cpe:2.3:h:hima:x-cpu_01:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
- cpe:2.3:o:hima:x-cpu_31_firmware:*:*:*:*:*:*:*:* Versions up to 14.16 Vulnerable ·HIMA
- cpe:2.3:h:hima:x-cpu_31:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
- cpe:2.3:o:hima:x-sb_01_firmware:*:*:*:*:*:*:*:* Versions up to 7.54 Vulnerable ·HIMA
- cpe:2.3:h:hima:x-sb_01:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·HIMA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-24782
- 2026-10-03 Alias added: GHSA-h29x-7wp6-7rpx
References
More HIMA F-com 01 Firmware vulnerabilities
- TI-2024-16298 Hima: Uncontrolled Resource Consumption in multiple products CVSS 3.1HIGH 7.5
Sources
- CVE-2024-24782 · CVE Program
- CVE-2024-24782 · NVD
- FIRST EPSS
- GHSA-h29x-7wp6-7rpx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences