Lucene search

Japan Vulnerability NotesJVN:45473612

HistoryAug 29, 2022 - 12:00 a.m.

JVN#45473612: Multiple vulnerabilities in CentreCOM AR260S V2

2022-08-2900:00:00

Japan Vulnerability Notes

jvn.jp

centrecom ar260s v2

firmware update

change passwords

os command injection

hard-coded credentials

undocumented hidden command

firewall protection

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

72.6%

JSON

CentreCOM AR260S V2 provided by Allied Telesis K.K. contains multiple vulnerabilities listed below.

OS command injection vulnerability in GUI setting page (CWE-78) - CVE-2022-35273

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Base Score: 8.8
CVSS v2	AV:N/AC:L/Au:S/C:C/I:C/A:C	Base Score: 9.0

Use of hard-coded credentials for the telnet server (CWE-798) - CVE-2022-38394

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 8.1
CVSS v2	AV:N/AC:M/Au:N/C:C/I:C/A:C	Base Score: 9.3

Undocumented hidden command that can be excuted from the telnet function (CWE-912) - CVE-2022-34869

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Base Score: 7.5
CVSS v2	AV:N/AC:H/Au:S/C:C/I:C/A:C	Base Score: 7.1

OS command injection vulnerability in the telnet function (CWE-78) - CVE-2022-38094

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Base Score: 7.5
CVSS v2	AV:N/AC:H/Au:S/C:C/I:C/A:C	Base Score: 7.1

Impact

A remote attacker may execute an arbitrary OS command.

Solution

Update the firmware and Change passwords
Update the firmware to the latest version according to the information provided by the developer, and then change all passwords including “guest” account passwords.

Apply the workaround
Applying the following workarounds may mitigate the impacts of these vulnerabilities.

Enable the Firewall protection
Change all passwords including “guest” account passwords

Products Affected

CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

72.6%

JSON

Related for JVN:45473612