Lucene search

Japan Vulnerability NotesJVN:77403442

HistoryJun 27, 2016 - 12:00 a.m.

JVN#77403442: Multiple Hikari Denwa routers vulnerable to OS command injection

2016-06-2700:00:00

Japan Vulnerability Notes

jvn.jp

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

74.2%

JSON

Multiple Hikari Denwa routers contain an OS command injection vulnerability (CWE-78).

Impact

An arbitrary OS command may be executed on the product by a logged-in attacker.

Solution

Update the Firmware
Apply the appropriate firmware update provided by the developer.

Products Affected

NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION

PR-400MI firmware Ver. 07.00.1006 and earlier
RV-440MI firmware Ver. 07.00.1006 and earlier
RT-400MI firmware Ver. 07.00.1006 and earlier
NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION
PR-400MI firmware Ver. 07.00.1005 and earlier
RV-440MI firmware Ver. 07.00.1005 and earlier
RT-400MI firmware Ver. 07.00.1005 and earlier

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004

Percentile

74.2%

JSON

Related for JVN:77403442