JVNDB-2022-000048

L2Blocker Sensor setup screen vulnerable to authentication bypass

L2Blocker provided by SOFTCREATE CORP. contains a vulnerability (CWE-288) in which the login authentication is bypassed by using alternative paths or channels for Sensor.

Cyber Defense Institute, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

SOFTCREATE CORP.

• L2Blocker (on-premise) Ver4.8.5 and earlier
• L2Blocker (Cloud) Ver4.8.5 and earlier

According the developer, EOS versions 3 series and ealier are also affected by this vulnerability.

An attacker who can access the device may perform an unauthorized login and obtain the stored information or cause a malfunction of the device.

[Update the Software]
Update to the latest version according to the information provided by the developer.
The developer released the following version that fixes the vulnerability.

• L2Blocker Ver4.8.6

According the developer, L2Blocker(Cloud) has already been updated by the developer, therefore no user update is required.

SOFTCREATE CORP.

• SOFTCREATE CORP. : Authentication bypass vulnerability in L2Blocker sensor setup screen (in Japanese)

1. Improper Authentication(CWE-287) [IPA Evaluation]

1. CVE-2022-33202

1. JVN : JVN#51464799
2. National Vulnerability Database (NVD) : CVE-2022-33202

• [2022/06/24]
    Web page was published
• [2024/06/18]
    References : Content was added