JVN#41017328: HOME SPOT CUBE2 vulnerable to OS command injection

HOME SPOT CUBE2 provided by KDDI CORPORATION contains an OS command injection vulnerability (CWE-78) due to improper processing of data received from DHCP server.

Impact

An arbitrary OS command may be executed on the product if a malicious DHCP server is placed on the WAN side of the product.

Solution

Apply the workaround
Applying following workaround may mitigate the impact of this vulnerability.

• Connect the WAN port of the product to a trusted ISP line
  The developer states that an attack exploiting this vulnerability is not realistic if the WAN port of the product is connected to a trusted ISP line.

Products Affected

• HOME SPOT CUBE2 V102 and earlier