|
[Japanese]
|
JVNDB-2021-000091
|
128 Technology Session Smart Router vulnerable to authentication bypass
|
|
128 Technology Session Smart Router provided by 128 Technology contains an authentication bypass vulnerability (CWE-287).
Genta Kataoka of IERAE SECURITY INC. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 9.8 (Critical) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
CVSS V2 Severity:
Base Metrics 7.5 (High) [IPA Score]
- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: Partial
- Availability Impact: Partial
|
|
|
128 Technology
- 128 Technology Session Smart Router versions from 4.4 to 5.0.1
|
|
|
A remote attacker may bypass the authentication and execute an arbitrary OS command with the root privilege.
|
|
[Update the software]
Update the software to the latest version according to the information provided by the developer.
According to the developer, 128T SSR 4.4 series is no longer supported and to continue using 4 series, users need to upgrade to 4.5.11. Also, 128T SSR 5.0.0 or 5.0.1 users need to upgrade to 5.1.6 or later.
For more information on upgrading, see Upgrading the 128T Networking Platform.
|
|
128 Technology
|
|
- Improper Authentication(CWE-287) [IPA Evaluation]
|
|
- CVE-2021-31349
|
|
- JVN : JVN#85073657
|
|
- [2021/10/18]
Web Page was published
|
