Lucene search

Japan Vulnerability NotesJVN:98295787

HistoryNov 30, 2017 - 12:00 a.m.

JVN#98295787: Multiple vulnerabilities in Wireless mobile storage "Digizo ShAirDisk" PTW-WMS1

2017-11-3000:00:00

Japan Vulnerability Notes

jvn.jp

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.007

Percentile

80.0%

JSON

Wireless mobile storage “Digizo ShAirDisk” PTW-WMS1 provided by Princeton Ltd. is a Wi-Fi storage. Wireless mobile storage “Digizo ShAirDisk” PTW-WMS1 contains multiple vulnerabilities listed below.

Improper Access Restriction (CWE-284) - CVE-2017-10900

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	Base Score: 7.3
CVSS v2	AV:N/AC:L/Au:N/C:P/I:P/A:P	Base Score: 7.5

Buffer Overflow (CWE-119) - CVE-2017-10901

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Base Score: 7.5
CVSS v2	AV:N/AC:L/Au:N/C:N/I:N/A:P	Base Score: 5.0

OS Command Injection (CWE-78) - CVE-2017-10902

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 9.8
CVSS v2	AV:N/AC:L/Au:N/C:P/I:P/A:P	Base Score: 7.5

Improper Authentication (CWE-287) - CVE-2017-10903

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 9.8
CVSS v2	AV:N/AC:L/Au:N/C:C/I:C/A:C	Base Score: 10.0

Impact

A remote attacker may access the shared disk connected to the device, and then obtain or delete information in the disk. - CVE-2017-10900
Receiving a specially crafted packet from a remote attacker may result in a denial-of-service (DoS) condition. - CVE-2017-10901
A remote attacker may log in the device and execute an arbitrary OS command. - CVE-2017-10902
A remote attacker may log in the device with the root privilege and conduct arbitrary operations. - CVE-2017-10903

Solution

Update the Firmware
Apply the latest firmware update to the information provided by the developer.

Products Affected

PTW-WMS1 firmware version 2.000.012

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.007

Percentile

80.0%

JSON

Related for JVN:98295787