JVN#25059363
Multiple I-O DATA network camera products multiple vulnerabilities

Overview

Multiple network camera products provided by I-O DATA DEVICE, INC. contain multiple vulnerabilities.

Products Affected

• TS-WRLP firmware version 1.01.02 and earlier
• TS-WRLA firmware version 1.01.02 and earlier

Description

Multiple network camera products provided by I-O DATA DEVICE, INC. contain multiple vulnerabilities listed below.

• OS Command injection (CWE-78) - CVE-2016-7819

  CVSS v3	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	Base Score: 6.8
  CVSS v2	AV:A/AC:L/Au:S/C:P/I:P/A:P	Base Score: 5.2

• Buffer Overflow (CWE-119) - CVE-2016-7820

  CVSS v3	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	Base Score: 6.8
  CVSS v2	AV:A/AC:L/Au:S/C:P/I:P/A:P	Base Score: 5.2

Impact

The impact of each vulnerability is as follows.

• An arbitrary OS command may be executed. - CVE-2016-7819
• Arbitrary code may be executed or a denial-of-service (DoS) condition may be caused. - CVE-2016-7820

Solution

Update the Firmware
Apply the appropriate firmware update provided by the developer.