|
[Japanese]
|
JVNDB-2022-002337
|
UNIMO Technology digital video recorders vulnerable to missing authentication for critical functions
|
|
Multiple digital video recorders provided by UNIMO Technology Co., Ltd do not perform authentication for some critical functions (CWE-306) in the device management web interface.
The reporter states that attacks exploiting this vulnerability have been observed.
Yoshiki Mori, Ushimaru Hayato and Masaki Kubo of National Institute of Information and Communications Technology Cybersecurity Research Institute reported this vulnerability to the developer and coordinated. After coordination was completed, this case was reported to JPCERT/CC and JPCERT/CC coordinated with the developer for the publication.
|
|
CVSS V3 Severity:
Base Metrics 9.8 (Critical) [Other]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
|
|
|
UNIMO Technology Co., Ltd
- UDR-JA1004 firmware v1.0.20.13 and earlier
- UDR-JA1008 firmware v1.0.20.13 and earlier
- UDR-JA1016 firmware v1.0.20.13 and earlier
- UDR-JA1016 firmware v2.0.20.13 and earlier
|
|
|
When a remote attacker sends a crafted request to the web interface, an arbitrary OS command may be executed on the product without authentication.
|
|
[Update the firmware]
Update the firmware to the latest version according to the information provided by the developer.
This vulnerability has been addressed in the firmware versions v1.0.21.0 and v2.0.21.0.
|
|
UNIMO Technology Co., Ltd
|
|
- Missing Authentication for Critical Function(CWE-306) [Other]
|
|
- CVE-2022-35733
|
|
- JVN : JVNVU#90821877
- National Vulnerability Database (NVD) : CVE-2022-35733
|
|
- [2022/08/23]
Web page was published
- [2024/06/14]
References : Content was added
|
