CVE-2023-38433
đ TL;DR
Fujitsu Real-time Video Transmission Gear 'IP series' devices contain hard-coded credentials that allow remote unauthenticated attackers to initialize or reboot the products. This vulnerability affects multiple Fujitsu IP series video transmission devices with specific firmware versions, potentially disrupting video transmission services.
đť Affected Systems
- IP-HE950E
- IP-HE950D
- IP-HE900E
- IP-HE900D
- IP-900E
- IP-920E
- IP-900D
- IP-900â ĄD
- IP-920D
- IP-90
- IP-9610
đŚ What is this software?
â ď¸ Risk & Real-World Impact
Worst Case
Remote attacker could repeatedly reboot devices, causing sustained denial of service and complete disruption of video transmission services.
Likely Case
Attackers reboot devices to temporarily disrupt video feeds during critical operations or events.
If Mitigated
With proper network segmentation and access controls, impact is limited to isolated network segments.
đŻ Exploit Status
Exploitation requires only knowledge of hard-coded credentials and network access to device management interface.
đ ď¸ Fix & Mitigation
â Official Fix
Patch Version: Check Fujitsu advisory for specific fixed versions per product
Vendor Advisory: https://www.fujitsu.com/global/products/computing/peripheral/video/download/
Restart Required: Yes
Instructions:
1. Download latest firmware from Fujitsu support site. 2. Backup current configuration. 3. Apply firmware update following vendor instructions. 4. Verify update completed successfully. 5. Test video transmission functionality.
đ§ Temporary Workarounds
Network Segmentation
allIsolate Fujitsu IP series devices in separate VLAN with strict access controls
Firewall Rules
linuxBlock external access to device management interfaces (typically HTTP/HTTPS ports)
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
𧯠If You Can't Patch
- Place devices behind VPN with strict authentication requirements
- Implement network monitoring for reboot/initialization attempts
đ How to Verify
Check if Vulnerable:
Check device firmware version via web interface or serial console and compare against affected versions listCheck Version:
Check via device web interface at http(s)://[device-ip]/ or serial console connectionVerify Fix Applied:
Confirm firmware version is updated beyond affected ranges and test that hard-coded credentials no longer workđĄ Detection & Monitoring
Log Indicators:
- Unexpected device reboots
- Initialization events from unknown IPs
- Failed authentication attempts followed by successful access
Network Indicators:
- HTTP/HTTPS requests to device management interface from unexpected sources
- POST requests to reboot/initialize endpoints
SIEM Query:
source="fujitsu-ip-device" AND (event="reboot" OR event="initialize") AND src_ip NOT IN [allowed_management_ips]