JVN#46372675: FlashAir fails to restrict access permissions in PhotoShare

FlashAirTM by Toshiba Corporation is an SDHC memory card which provides wireless LAN access functions. FlashAirTM PhotoShare function enables to share the selected data with other users as it switches the original wireless LAN connection set by FlashAirTM default to the wireless LAN connection for PhotoShare.

FlashAirTM fails to restrict access permissions (CWE-425) in PhotoShare.

Impact

A user who access PhotoShare may obtain image data that are set not to be shared with other users.

Because of the vulnerability stated in JVN#81820501, when enabling PhotoShare with web browsers, an attacker with access to the wireless LAN may obtain these image data.

Solution

Update the software and configure appropriate wireless LAN setting
Update to the latest software versions of the product using the latest version of FlashAirTM Software Update tool (V3.00.02 or V2.00.04), and set SSID and password using appropriate application (either for Android or iOS) to prevent unintended accesses.
For more details, refer to the information provided by the developer.

Products Affected

• FlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier
• FlashAirTM SDHC Memory Card (SD-WD/WC Series <W-02>) V2.00.04 and earlier
  For more details, refer to the information provided by the developer.