Lucene search

Japan Vulnerability NotesJVN:54795166

HistoryOct 17, 2017 - 12:00 a.m.

JVN#54795166: Home unit KX-HJB1000 contains multiple vulnerabilities

2017-10-1700:00:00

Japan Vulnerability Notes

jvn.jp

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

49.4%

JSON

Home unit KX-HJB1000 provided by Panasonic Corporation is a control system for home network. Home unit KX-HJB1000 contains multiple vulnerabilities listed below.

Improper access control - CVE-2017-2131

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	Base Score: 5.3
CVSS v2	AV:N/AC:L/Au:N/C:P/I:N/A:N	Base Score: 5.0

Deletion of an arbitrary file in the specific directory- CVE-2017-2132

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	Base Score: 6.5
CVSS v2	AV:N/AC:L/Au:N/C:N/I:P/A:P	Base Score: 6.4

SQL injection (CWE-89****) - CVE-2017-2133

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	Base Score: 4.7
CVSS v2	AV:N/AC:L/Au:S/C:P/I:P/A:P	Base Score: 6.5

Impact

A user with access to the affected product may view the configuration menu - CVE-2017-2131
A user with access to the affected product may delete arbitrary files in the specific directory - CVE-2017-2132
A user who can log in to the affected product may obtain or alter information on the product - CVE-2017-2133

Solution

Update the Firmware
Apply the appropriate firmware update according to the information provided by the developer.

Products Affected

Following firmware and earlier versions of Home unit KX-HJB1000 are affected.

GHX1YG 14.50
HJB1000_4.47

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

49.4%

JSON

Related for JVN:54795166