JVN#18228200: Multiple vulnerabilities in WFS-SR01

WFS-SR01 provided by I-O DATA DEVICE, INC. is a portable storage device which provides wireless LAN router function. WFS-SR01 contains multiple vulnerabilities in “Pocket Router Function” listed below.

Command injection - CVE-2016-7806

Access restriction bypass - CVE-2016-7807

Impact

The impact of each vulnerability is as follows.

• An unauthenticated remote attacker may execute arbitrary commands on the device (CVE-2016-7806)
• An unauthenticated remote attacker may access SD card or other memory devices inserted into the product (CVE-2016-7807)

Solution

Update the Firmware
On 15 November, 2016, the firmware update which contains a fix for this vulnerability was released.
Update to the latest version of the firmware according to the information provided by the developer.

Products Affected

• WFS-SR01 firmware version 1.10 and earlier