JVN#21636825: A-Stage SCT-40CM01SR and AT-40CM01SR vulnerable to authentication bypass

SCT-40CM01SR and AT-40CM01SR provided by A-Stage Inc. are liquid crystal televisions. SCT-40CM01SR and AT-40CM01SR contain an authentication bypass vulnerability (CWE-287).

Impact

An attacker who can access the device may log in via telnet without authentication and execute an arbitrary command.

According to the developer, even if an arbitrary command is executed, programs regarding the functions of the products can not be altered or deleted.

Solution

Update the firmware
Update the firmware to the latest version according to the information provided by the developer.
According to the developer, the update requires a repair support by the developer. For more information, contact the developer.

Products Affected

• SCT-40CM01SR and AT-40CM01SR