title: Communication between the client and server partially using CORBA over TCP/IP
description:
Communication between the client and the server application of the affected products is partially done using CORBA (Common Object Request Broker Architecture) over TCP/IP. This protocol is not encrypted and allows tracing of internal messages.
This issue affects
*  FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C;
*  UNEM product: UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C.
List of CPEs:
*  cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:*
*  cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*
problem types: CWE-319 Cleartext Transmission of Sensitive Information
affected:
{
defaultStatus: unaffected
product: FOXMAN-UN
vendor: Hitachi Energy
versions:
status: unaffected, version: FOXMAN-UN R16A
status: affected, version: FOXMAN-UN R15B
status: affected, version: FOXMAN-UN R15A
status: affected, version: FOXMAN-UN R14B
status: affected, version: FOXMAN-UN R14A
status: affected, version: FOXMAN-UN R11B
status: affected, version: FOXMAN-UN R11A
status: affected, version: FOXMAN-UN R10C
status: affected, version: FOXMAN-UN R9C
}
{
defaultStatus: unaffected
product: UNEM
vendor: Hitachi Energy
versions:
status: unaffected, version: UNEM R16A
status: affected, version: UNEM R15B
status: affected, version: UNEM R15A
status: affected, version: UNEM R14B
status: affected, version: UNEM R14A
status: affected, version: UNEM R11B
status: affected, version: UNEM R11A
status: affected, version: UNEM R10C
status: affected, version: UNEM R9C
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds:
For immediate recommended mitigation actions if using FOXMAN-UN R15B or UNEM R15B and earlier, please refer to the multiple clauses of section Mitigation Factors/Workarounds in the advisory
*  Secure the NMS CLIENT/SERVER communication.