|
[Japanese]
|
JVNDB-2023-001852
|
OS command injection vulnerability in Inaba Denki Sangyo Wi-Fi AP UNIT
|
|
Wi-Fi AP UNIT provided by Inaba Denki Sangyo Co., Ltd. contains an OS command injection vulnerability (CWE-78).
Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC.
JPCERT/CC coordinated with the developer.
|
|
CVSS V3 Severity:
Base Metrics 7.2 (High) [Other]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
CVSS V2 Severity:
Base Metrics 6.5 (Medium) [Other]
- Access Vector: Network
- Access Complexity: Low
- Authentication: Single Instance
- Confidentiality Impact: Partial
- Integrity Impact: Partial
- Availability Impact: Partial
|
|
|
INABA DENKI SANGYO CO., LTD.
- AC-PD-WAPU v1.05_B04 and earlier
- AC-PD-WAPU-P v1.05_B04P and earlier
- AC-PD-WAPUM v1.05_B04 and earlier
- AC-PD-WAPUM-P v1.05_B04P and earlier
- AC-WAPU-300 v1.00_B07 and earlier
- AC-WAPU-300-P v1.00_B08P and earlier
- AC-WAPUM-300 v1.00_B07 and earlier
- AC-WAPUM-300-P v1.00_B08P and earlier
|
OS command injection vulnerability in Wi-Fi AP UNIT (PDF,in Japanese)
|
|
An arbitrary OS command may be executed by an authenticated user with the administrative privilege.
|
|
[Apply the workaround]
The developer states that these products are no longer supported and recommends the following mitigations.
* Change the initial configuration values
* Change IP address
* Change device operation setting
* Prohibit access to the WEB UI (the setting page) from WAN/Wireless interface (Only allow through the front LAN port)
* Change filtering configuration
* Set the MAC address of the client to allow wireless connection
* Configure VPN, IP filters, etc. to restrict connections from the client
* Other Cautions
* Setup a firewall and run the product behind it
* Do not access to other websites while logged into the setting page of the product
* Close the web browser after finishing the operation in the setting page
* Delete the password for the setting page saved in the web browser
|
|
|
|
- SQL Injection(CWE-89) [Other]
|
|
- CVE-2023-28392
|
|
- JVN : JVNVU#98968780
- National Vulnerability Database (NVD) : CVE-2023-28392
|
|
- [2023/05/17]
Web page was published
- [2023/06/12]
Affected Products : Products were added
Impact was modified
Solution was modified
|
