JVN#18228200: Multiple vulnerabilities in WFS-SR01

2016-11-02T00:00:00
ID JVN:18228200
Type jvn
Reporter Japan Vulnerability Notes
Modified 2016-11-15T00:00:00

Description

## Description

WFS-SR01 provided by I-O DATA DEVICE, INC. is a portable storage device which provides wireless LAN router function. WFS-SR01 contains multiple vulnerabilities in "Pocket Router Function" listed below.

  • Command injection - CVE-2016-7806 CVSS v3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | Base Score: 7.3
    ---|---|---
    CVSS v2 | AV:N/AC:L/Au:N/C:P/I:P/A:P | Base Score: 7.5
  • Access restriction bypass - CVE-2016-7807 CVSS v3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | Base Score: 7.3
    ---|---|---
    CVSS v2 | AV:N/AC:L/Au:N/C:P/I:P/A:P | Base Score: 7.5

## Impact

The impact of each vulnerability is as follows.

  • An unauthenticated remote attacker may execute arbitrary commands on the device (CVE-2016-7806)
  • An unauthenticated remote attacker may access SD card or other memory devices inserted into the product (CVE-2016-7807)

## Solution

Update the Firmware
On 15 November, 2016, the firmware update which contains a fix for this vulnerability was released.
Update to the latest version of the firmware according to the information provided by the developer.

## Products Affected

  • WFS-SR01 firmware version 1.10 and earlier