JVN#21528670
SecureCore Standard Edition vulnerable to authentication bypass
Overview
SecureCore Standard Edition contains an authentication bypass vulnerability.
Products Affected
- SecureCore Standard Edition Version 2.x
Description
SecureCore Standard Edition provided by Feitian Japan Co., Ltd. contains an authentication bypass vulnerability (CWE-287).
Impact
An attacker may bypass the product's authentication and log in to a Windows PC.
Solution
Update the Software
Update the software to the latest version according to the information provided by the developer.
Apply the Patch
Apply the patch according to the information provided by the developer.
For more information, refer to the information provided by the developer.
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Daisuke Ota of BizReach, inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2018-16160 |
| JVN iPedia |
JVNDB-2018-000112 |
Update History
- 2018/11/09
- [Vulnerability Analysis by JPCERT/CC] is now displayed