JVN#35062083: Multiple I-O DATA Recording Hard disk products vulnerable to cross-site request forgery

Multiple Recording Hard disk products provided by I-O DATA DEVICE, INC. contain a cross-site request forgery vulnerability due to an issue in the web management screen.

Impact

If a user views a malicious page, an arbitrary content may be deleted.

Solution

Update the Firmware
Apply the appropriate firmware update provided by the developer.

Products Affected

• HVL-A2.0 firmware versions prior to 2.04
• HVL-A3.0 firmware versions prior to 2.04
• HVL-A4.0 firmware versions prior to 2.04
• HVL-AT1.0S firmware versions prior to 2.04
• HVL-AT2.0 firmware versions prior to 2.04
• HVL-AT3.0 firmware versions prior to 2.04
• HVL-AT4.0 firmware versions prior to 2.04
• HVL-AT2.0A firmware versions prior to 2.04
• HVL-AT3.0A firmware versions prior to 2.04
• HVL-AT4.0A firmware versions prior to 2.04