JVN#55121369: CentreCOM AR260S V2 vulnerable to privilege escalation

​CentreCOM AR260S V2 provided by Allied Telesis K.K. is a wired LAN router. CentreCOM AR260S V2 contains a privilege escalation vulnerability.

Impact

Unintended operations may be performed with administrative privileges by a user who can log into the product with “guest” account.

Solution

Apply Workarounds
The following workarounds may mitigate the impacts of this vulnerability.

• Change the password of the account “guest”
  The default password of the account “guest” is publicly known. Change the password of the account “guest” immediately to prevent an unauthenticated attacker from logging into the product.
• Do not allow untrusted person to use the account “guest”
  Once logged into the vulnerable product as “guest”, this vulnerability can be exploited. Therefore do not allow untrusted person to use the “guest” account.
• Enable the Firewall protection
  The product has a firewall protection, and it is enabled by default. Enable firewall to protect the product from unintended accesses from WAN side.

Products Affected

• CentreCOM AR260S V2