|
[Japanese]
|
JVNDB-2016-000106
|
Multiple Hikari Denwa routers vulnerable to cross-site request forgery
|
|
Multiple Hikari Denwa routers contain a cross-site request forgery vulnerability (CWE-352).
Ryoya Tsukasaki of Urawa Commercial High School reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 7.1 (High) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
CVSS V2 Severity:
Base Metrics 4.0 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: High
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: Partial
- Availability Impact: None
|
|
|
NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION
- PR-400MI firmware Ver. 07.00.1005 and earlier
- RT-400MI firmware Ver. 07.00.1005 and earlier
- RV-440MI firmware Ver. 07.00.1005 and earlier
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
- PR-400MI firmware Ver. 07.00.1006 and earlier
- RT-400MI firmware Ver. 07.00.1006 and earlier
- RV-440MI firmware Ver. 07.00.1006 and earlier
|
|
|
If a user views a malicious page while logged in, unintended operations may be performed.
|
|
[Update the Firmware]
Apply the appropriate firmware update provided by the developer.
|
|
NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION
|
|
- Cross-Site Request Forgery(CWE-352) [IPA Evaluation]
|
|
- CVE-2016-1228
|
|
- JVN : JVN#45034304
- National Vulnerability Database (NVD) : CVE-2016-1228
|
|
- [2016/06/27]
Web page was published
[2016/08/03]
References : Content was added
|
