TI-2024-31428 Aliases CVE-2024-47044 GHSA-5ggj-j87m-p7xh

Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE…

LOW 30CWE-451Published 2024-09-26 · Updated 2024-10-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-451.

Summary

Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for Device Setting pages. If this vulnerability is exploited, an attacker who identified WAN-side IPv6 address may access the product's Device Setting page via WAN-side. Note that, the same products are also provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION, but the vulnerability only affects products subscribed and used in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION areas.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00428 37th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION	Hikari Denwa router RT-400MI	Ver.09.00.0015 and earlier	—	No fix listed	CNA
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION	Hikari Denwa router PR-400MI	Ver.09.00.0015 and earlier	—	No fix listed	CNA
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION	Hikari Denwa router RV-440MI	Ver.09.00.0015 and earlier	—	No fix listed	CNA
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION	Home GateWay/Hikari Denwa router PR-500MI/RS-500MI/RT-500MI	Ver.08.00.0004 and earlier	—	No fix listed	CNA
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION	Home GateWay/Hikari Denwa router PR-600MI/RX-600MI	Ver.01.00.0008 and earlier	—	No fix listed	CNA

Hikari Denwa router RT-400MI VendorNIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Affected Ver.09.00.0015 and earlier Fixed in — No fix listed CNA
Hikari Denwa router PR-400MI VendorNIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Affected Ver.09.00.0015 and earlier Fixed in — No fix listed CNA
Hikari Denwa router RV-440MI VendorNIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Affected Ver.09.00.0015 and earlier Fixed in — No fix listed CNA
Home GateWay/Hikari Denwa router PR-500MI/RS-500MI/RT-500MI VendorNIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Affected Ver.08.00.0004 and earlier Fixed in — No fix listed CNA
Home GateWay/Hikari Denwa router PR-600MI/RX-600MI VendorNIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Affected Ver.01.00.0008 and earlier Fixed in — No fix listed CNA

CPE names CISA-ADP · 8

CPE	Versions	Role	Vendor
cpe:2.3:o:ntt-east:pr-400mi_firmware:-:::::::*	not specified by CISA-ADP	—	NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:rt-400mi_firmware:-:::::::*	not specified by CISA-ADP	—	NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:rv-440mi_firmware:-:::::::*	not specified by CISA-ADP	—	NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:pr-500mi_firmware:-:::::::*	not specified by CISA-ADP	—	NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:rs-500mi_firmware:-:::::::*	not specified by CISA-ADP	—	NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:rt-500mi_firmware:-:::::::*	not specified by CISA-ADP	—	NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:pr-600mi_firmware::::::::	—	—	NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:rx-600mi_firmware::::::::	—	—	NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION

cpe:2.3:o:ntt-east:pr-400mi_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:rt-400mi_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:rv-440mi_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:pr-500mi_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:rs-500mi_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:rt-500mi_firmware:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:pr-600mi_firmware:*:*:*:*:*:*:*:* Versions — — ·NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
cpe:2.3:o:ntt-east:rx-600mi_firmware:*:*:*:*:*:*:*:* Versions — — ·NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-47044
2026-10-03 Alias added: GHSA-5ggj-j87m-p7xh

References

Other 7

TI-2016-01126 Cross-site request forgery (CSRF) vulnerability on NTT EAST Hikari Denwa routers with… CVSS 3.1HIGH 8.8
TI-2022-07161 OS command injection in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION (NTT East) and… CVSS 3.1HIGH 8.8
TI-2019-04276 Cross-site request forgery in Hikari Denwa router/Home GateWay CVSS 3.1HIGH 8.8
TI-2017-07930 Untrusted search path in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION Remote Support… CVSS 3.0HIGH 7.8
TI-2018-00520 Untrusted search path in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION the installer of… CVSS 3.0HIGH 7.8
TI-2018-00472 Untrusted search path in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION "FLET'S Azukeru… CVSS 3.0HIGH 7.8

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences