CVE-2024-2013

CRITICAL

An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the services and the post-...

Affects 2 products across 1 vendor.

BCS6.5
CVSS 3.110.0
EPSS0.7%
Percentile50th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-288: CWE-288
CWE-306: Missing Authentication for Critical Function

Software does not perform any authentication for functionality that requires a verified identity.

Related Attack Patterns (CAPEC)
CAPEC-127 Directory Indexing
via CWE-288
CAPEC-665 Exploitation of Thunderbolt Protection Flaws
via CWE-288
CAPEC-12 Choosing Message Identifier
via CWE-306
CAPEC-36 Using Unpublished Interfaces or Functionality
via CWE-306
CAPEC-62 Cross Site Request Forgery
via CWE-306
Show all 7

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical authentication bypass vulnerability in the FOXMAN-UN/UNEM server/API Gateway component allows unauthorized access to services and post-authentication functionalities.

BSID: BS-2024-GLOBAL-207289-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-2013?
A critical authentication bypass vulnerability in the FOXMAN-UN/UNEM server/API Gateway component allows unauthorized access to services and post-authentication functionalities.
What is the CVSS score for CVE-2024-2013?
CVE-2024-2013 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 0.7%.
Is CVE-2024-2013 actively exploited?
No confirmed active exploitation of CVE-2024-2013 as of 2026-09-25.
How do I remediate CVE-2024-2013?
Priority: IMMEDIATE. Advisory: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true PSIRT: [email protected]
What systems are affected by CVE-2024-2013?
CVE-2024-2013 affects: Hitachienergy, Hitachienergy.
Vulnerability Details
CVE IDCVE-2024-2013
BSIDBS-2024-GLOBAL-207289-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2024-06-11
Last Modified2026-06-17
ICS Relevance70%
Weakness (CWE)
CWE-288Missing Authentication for Critical Function
SourceNVD
Official Description

An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the services and the post-authentication attack surface.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability exists in the authentication mechanism of the FOXMAN-UN/UNEM server/API Gateway, enabling attackers to bypass authentication and interact with the system as if they were authenticated users.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Hitachienergy Foxman-Un —
Hitachienergy Unem —
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: September 2026 | Threat Age: 839 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash77bac225008ece43a28108efe58ecc4d3da28e7eeb558f7296e914dacf263db1ad5c7dca2a2abf317ee64d8d42af8864584dfd4aaa07d706bc240722bfee8fa2
Related CVEs affecting Hitachienergy
CVE-2019-18253 10.0 An attacker could use specially crafted paths in a specific request to read o... CVE-2021-40342 9.8 In the DES implementation, the affected product versions use a default key f... CVE-2019-5620 9.8 ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Mi... CVE-2018-14805 9.8 ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP... CVE-2022-3927 9.8 The affected products store both public and private key that are used to sig...
View all Hitachienergy CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →