CVE-2024-23788
📋 TL;DR
This CVE describes a server-side request forgery (SSRF) vulnerability in Sharp Energy Management Controllers. An unauthenticated attacker on the same network can force the device to send arbitrary HTTP GET requests to internal or external systems. This affects JH-RVB1 and JH-RV11 controllers running firmware version B0.1.9.1 or earlier.
💻 Affected Systems
- Sharp Energy Management Controller JH-RVB1
- Sharp Energy Management Controller JH-RV11
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker could pivot to internal systems, access cloud credentials, perform port scanning, or launch attacks against internal services using the device as a proxy.
Likely Case
Information disclosure from internal HTTP services, reconnaissance of internal network, or limited data exfiltration.
If Mitigated
Limited to network-adjacent attacks only, with no authentication bypass or code execution on the controller itself.
🎯 Exploit Status
No authentication required, simple HTTP request manipulation. Network adjacency is the main requirement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: B0.1.9.2 or later
Vendor Advisory: https://jp.sharp/support/taiyo/info/JVNVU94591337_en.pdf
Restart Required: Yes
Instructions:
1. Download firmware update from Sharp support site. 2. Upload firmware to controller via web interface. 3. Apply update. 4. Reboot controller.
🔧 Temporary Workarounds
Network Segmentation
allIsolate energy management controllers on separate VLAN with strict firewall rules.
Access Control Lists
allImplement network ACLs to restrict which devices can communicate with the controllers.
🧯 If You Can't Patch
- Segment controllers on isolated network with no internet access
- Implement strict firewall rules to limit controller communication to only necessary services
🔍 How to Verify
Check if Vulnerable:
Check firmware version via controller web interface or SSH if available. Version B0.1.9.1 or earlier is vulnerable.Check Version:
Check via web interface at http://[controller-ip]/status or similar endpointVerify Fix Applied:
Verify firmware version is B0.1.9.2 or later after update.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests originating from controller IP
- Controller making requests to unexpected internal/external endpoints
Network Indicators:
- Controller making HTTP GET requests to non-standard ports or internal IPs
- Unusual outbound traffic patterns from controller
SIEM Query:
source_ip=[controller_ip] AND http_method=GET AND (dst_port!=80 OR dst_port!=443)