Lucene search

JpcertCVE-2022-26834

HistoryJun 13, 2022 - 5:15 a.m.

CVE-2022-26834

2022-06-1305:15:11

jpcert

web.nvd.nist.gov

cve-2022-26834

improper access control

vulnerability

rakuten casa

remote attacker

http connections

wan side

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.003

Percentile

66.4%

JSON

Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to obtain the information stored in the product because the product is set to accept HTTP connections from the WAN side by default.

Affected configurations

Nvd

Node

rakutencasaMatchap_f_v1_4_1

rakutencasaMatchap_f_v2_0_0

VendorProductVersionCPE
rakutencasaap_f_v1_4_1cpe:2.3:a:rakuten:casa:ap_f_v1_4_1:*:*:*:*:*:*:*
rakutencasaap_f_v2_0_0cpe:2.3:a:rakuten:casa:ap_f_v2_0_0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rakuten	casa	ap_f_v1_4_1	cpe:2.3:a:rakuten:casa:ap_f_v1_4_1:::::::*
rakuten	casa	ap_f_v2_0_0	cpe:2.3:a:rakuten:casa:ap_f_v2_0_0:::::::*

CNA Affected

[
  {
    "product": "Rakuten Casa",
    "vendor": "Rakuten Mobile, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "version AP_F_V1_4_1 or AP_F_V2_0_0"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN46892984/index.html

network.mobile.rakuten.co.jp/information/news/product/1033/

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.4

Confidence

High

EPSS

0.003

Percentile

66.4%

JSON

Related for CVE-2022-26834