JVN#96561229: Multiple vulnerabilities in Operation management interface of FUJITSU Network IPCOM

FUJITSU Network IPCOM provided by FUJITSU LIMITED is an integrated network appliance.
Operation management interface used to operate FUJITSU Network IPCOM contains multiple vulnerabilities listed below.

OS command injection in the web console (CWE-78) - CVE-2022-29516

Buffer overflow in the Command Line Interface (CWE-120) - CVE-2020-10188
The product uses previous versions of netkit-telnet which contains a known vulnerability.

Impact

• A remote attacker may execute an arbitrary OS command.
• A remote attacker may obtain and/or alter sensitive information.
• A remote attackerr may be able to cause a denial-of-service (DoS).

Solution

Update the Firmware
Update the firmware to the latest version according to the information provided by the developer.
These vulnerabilities have been already addressed in the following firmware versions.

• IPCOM EX2 V01L05 NF0501

• IPCOM EX2 V01L20 NF0301

• IPCOM EX2 V02L21 NF0201

• IPCOM EX E20L33 NF1101

• IPCOM EX E30L11 NF0501

• IPCOM VE2 V01L05 NF0303

• IPCOM VA2/VE1 E20L33 NF0902
  Apply the Workaround
  Apply one of the following workarounds to prevent unauthorized access from other than authorized Operation management terminal:

• Prepare a dedicated network to deploy Operation management interface and allow access to the Operation management interface only from the network

• Set individual permissions for Operation management terminal
  For more information, refer to the information provided by the developer. (Text in Japanese)

Products Affected

• IPCOM EX2 series
• IPCOM EX series
• IPCOM VE2 series
• IPCOM VA2/VE1 series