|
[Japanese]
|
JVNDB-2016-000134
|
Multiple I-O DATA Recording Hard disk products vulnerable to cross-site request forgery
|
|
Multiple Recording Hard disk products provided by I-O DATA DEVICE, INC. contain a cross-site request forgery vulnerability due to an issue in the web management screen.
kaito834 reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
CVSS V2 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
|
|
|
I-O DATA DEVICE, INC.
- HVL-A2.0 firmware versions prior to 2.04
- HVL-A3.0 firmware versions prior to 2.04
- HVL-A4.0 firmware versions prior to 2.04
- HVL-AT1.0S firmware versions prior to 2.04
- HVL-AT2.0 firmware versions prior to 2.04
- HVL-AT2.0A firmware versions prior to 2.04
- HVL-AT3.0 firmware versions prior to 2.04
- HVL-AT3.0A firmware versions prior to 2.04
- HVL-AT4.0 firmware versions prior to 2.04
- HVL-AT4.0A firmware versions prior to 2.04
|
|
|
If a user views a malicious page, an arbitrary content may be deleted.
|
|
[Update the Firmware]
Apply the appropriate firmware update provided by the developer.
|
|
I-O DATA DEVICE, INC.
|
|
- Cross-Site Request Forgery(CWE-352) [IPA Evaluation]
|
|
- CVE-2016-4845
|
|
- JVN : JVN#35062083
- National Vulnerability Database (NVD) : CVE-2016-4845
|
|
- [2016/08/08]
Web page was published
[2016/10/24]
References : Content was added
|
