CVE-2024-45837
Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System...
Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthenticated attacker may log in to SFTP service and obtain and/or manipulate unauthorized files.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthenticated attacker may log in to SFTP service and obtain and/or manipulate unauthorized files.
- Record
CVE-2024-45837- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-321
- Updated
- 2026-11-02
EUVDEUVD-2024-41695
Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthenticated attacker may log in to SFTP service and obtain and/or manipulate unauthorized files.
- Record
EUVD-2024-41695- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rjm6-gxhw-jxmp
Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System...
Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthenticated attacker may log in to SFTP service and obtain and/or manipulate unauthorized files.
- Record
GHSA-rjm6-gxhw-jxmp- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-321
- Updated
- 2026-11-02
NVD
Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A network-adjacent unauthenticated attacker may log in to SFTP service and obtain and/or manipulate unauthorized files.
- Record
CVE-2024-45837- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-321
- Updated
- 2026-11-02
Affected products
- aiphone co., ltd. ix-ba
- aiphone co., ltd. ix-bau
- aiphone co., ltd. ix-bb
- aiphone co., ltd. ix-bbt
- aiphone co., ltd. ix-bu
- aiphone co., ltd. ix-da
- aiphone co., ltd. ix-dau
- aiphone co., ltd. ix-db
- aiphone co., ltd. ix-dbt
- aiphone co., ltd. ix-du
- aiphone co., ltd. ix-dv
- aiphone co., ltd. ix-dvf
Show 44 moreShow less
- aiphone co., ltd. ix-dvf-2ra
- aiphone co., ltd. ix-dvf-l
- aiphone co., ltd. ix-dvf-p
- aiphone co., ltd. ix-dvf-ra
- aiphone co., ltd. ix-dvm
- aiphone co., ltd. ix-dvt
- aiphone co., ltd. ix-ea
- aiphone co., ltd. ix-eat
- aiphone co., ltd. ix-eau
- aiphone co., ltd. ix-fa
- aiphone co., ltd. ix-mv
- aiphone co., ltd. ix-mv7-b
- aiphone co., ltd. ix-mv7-bt
- aiphone co., ltd. ix-mv7-hb
- aiphone co., ltd. ix-mv7-hbt
- aiphone co., ltd. ix-mv7-hw
- aiphone co., ltd. ix-mv7-hw-jp
- aiphone co., ltd. ix-mv7-hwt
- aiphone co., ltd. ix-mv7-w
- aiphone co., ltd. ix-mv7-wt
- aiphone co., ltd. ix-rs-b
- aiphone co., ltd. ix-rs-bt
- aiphone co., ltd. ix-rs-w
- aiphone co., ltd. ix-rs-wt
- aiphone co., ltd. ix-spmic
- aiphone co., ltd. ix-ss-2g
- aiphone co., ltd. ix-ss-2g-n
- aiphone co., ltd. ix-ss-2gt
- aiphone co., ltd. ix-ssa
- aiphone co., ltd. ix-ssa-2ra
- aiphone co., ltd. ix-ssa-ra
- aiphone co., ltd. ix-supporttool
- aiphone co., ltd. ixg-2c7
- aiphone co., ltd. ixg-2c7-l
- aiphone co., ltd. ixg-dm7
- aiphone co., ltd. ixg-dm7-10k
- aiphone co., ltd. ixg-dm7-hid
- aiphone co., ltd. ixg-dm7-hida
- aiphone co., ltd. ixg-mk
- aiphone co., ltd. ixg-supporttool
- aiphone co., ltd. ixgw-gw
- aiphone co., ltd. ixgw-lc
- aiphone co., ltd. ixgw-tgw
- aiphone co., ltd. ixw-ma
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45837 is a medium vulnerability (CVSS 5.4) in Aiphone Co., Ltd. Ix-ba, published November 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. No source names a fixed version.