128 Technology Session Smart Router vulnerable to authentication bypass


128 Technology Session Smart Router provided by 128 Technology contains an authentication bypass vulnerability (CWE-287).

Genta Kataoka of IERAE SECURITY INC. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 9.8 (Critical) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS V2 Severity:
Base Metrics 7.5 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
Affected Products

128 Technology
  • 128 Technology Session Smart Router versions from 4.4 to 5.0.1


A remote attacker may bypass the authentication and execute an arbitrary OS command with the root privilege.

[Update the software]
Update the software to the latest version according to the information provided by the developer.
According to the developer, 128T SSR 4.4 series is no longer supported and to continue using 4 series, users need to upgrade to 4.5.11. Also, 128T SSR 5.0.0 or 5.0.1 users need to upgrade to 5.1.6 or later.
For more information on upgrading, see Upgrading the 128T Networking Platform.
Vendor Information

128 Technology
CWE (What is CWE?)

  1. Improper Authentication(CWE-287) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2021-31349

  1. JVN : JVN#85073657
Revision History

  • [2021/10/18]
      Web Page was published