[Japanese]

JVNDB-2022-002337

UNIMO Technology digital video recorders vulnerable to missing authentication for critical functions

Overview

Multiple digital video recorders provided by UNIMO Technology Co., Ltd do not perform authentication for some critical functions (CWE-306) in the device management web interface.

The reporter states that attacks exploiting this vulnerability have been observed.

Yoshiki Mori, Ushimaru Hayato and Masaki Kubo of National Institute of Information and Communications Technology Cybersecurity Research Institute reported this vulnerability to the developer and coordinated. After coordination was completed, this case was reported to JPCERT/CC and JPCERT/CC coordinated with the developer for the publication.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 9.8 (Critical) [Other]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
Affected Products


UNIMO Technology Co., Ltd
  • UDR-JA1004 firmware v1.0.20.13 and earlier
  • UDR-JA1008 firmware v1.0.20.13 and earlier
  • UDR-JA1016 firmware v1.0.20.13 and earlier
  • UDR-JA1016 firmware v2.0.20.13 and earlier

Impact

When a remote attacker sends a crafted request to the web interface, an arbitrary OS command may be executed on the product without authentication.
Solution

[Update the firmware]
Update the firmware to the latest version according to the information provided by the developer.
This vulnerability has been addressed in the firmware versions v1.0.21.0 and v2.0.21.0.
Vendor Information

UNIMO Technology Co., Ltd
CWE (What is CWE?)

  1. Missing Authentication for Critical Function(CWE-306) [Other]
CVE (What is CVE?)

  1. CVE-2022-35733
References

  1. JVN : JVNVU#90821877
Revision History

  • [2022/08/23]
      Web page was published