JVNDB-2008-000079

I-O DATA DEVICE HDL-F series cross-site request forgery vulnerability

The HDL-F series products from I-O DATA DEVICE, INC. are LAN connectable hard disk drives. The web interface for administration in the products contains a cross-site request forgery vulnerability.

The HDL-F series products provided by I-O DATA DEVICE, INC. are LAN connectable hard disk drives. Configuration of these devices are done through a web-based interface. This web interface is vulnerable to cross-site request forgery.

Firmware updates addressing this vulnerability have been provided by the vendor since August 28, 2008.

Takayuki Ogiso reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendor under Information Security Early Warning Partnership.

I-O DATA DEVICE, INC.

• HDL-F Series (f)

If a user views a malicious web page while logged into the web-based interface, an attacker could modify configurations or delete data on the hard disk drive.

[Update the Software]
Apply the firmware updates provided by the vendor.

I-O DATA DEVICE, INC.

• I-O DATA : hdl-f (Japanese)
• I-O DATA : HDL-F (Japanese)

1. Cross-Site Request Forgery(CWE-352) [IPA Evaluation]

1. CVE-2008-5382

1. JVN : JVN#70599814
2. National Vulnerability Database (NVD) : CVE-2008-5382
3. IPA SECURITY ALERTS : Security Alert for I-O DATA DEVICE HDL-F Series Vulnerability
4. Secunia Advisory : SA32836
5. OPEN SOURCE VULNERABILITY DATABASE (OSVDB) : 50183
6. JVN iPedia (Japanese) : JVNDB-2008-000079

• [2008/12/02]
    Web page published