JVN#54795166
Home unit KX-HJB1000 contains multiple vulnerabilities

Overview

Home unit KX-HJB1000 provided by Panasonic Corporation contains multiple vulnerabilities.

Products Affected

Following firmware and earlier versions of Home unit KX-HJB1000 are affected.

• GHX1YG 14.50
• HJB1000_4.47

Description

Home unit KX-HJB1000 provided by Panasonic Corporation is a control system for home network. Home unit KX-HJB1000 contains multiple vulnerabilities listed below.

• Improper access control - CVE-2017-2131

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	Base Score: 5.3
  CVSS v2	AV:N/AC:L/Au:N/C:P/I:N/A:N	Base Score: 5.0

• Deletion of an arbitrary file in the specific directory - CVE-2017-2132

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	Base Score: 6.5
  CVSS v2	AV:N/AC:L/Au:N/C:N/I:P/A:P	Base Score: 6.4

• SQL injection (CWE-89) - CVE-2017-2133

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	Base Score: 4.7
  CVSS v2	AV:N/AC:L/Au:S/C:P/I:P/A:P	Base Score: 6.5

Impact

• A user with access to the affected product may view the configuration menu - CVE-2017-2131
• A user with access to the affected product may delete arbitrary files in the specific directory - CVE-2017-2132
• A user who can log in to the affected product may obtain or alter information on the product - CVE-2017-2133

Solution

Update the Firmware
Apply the appropriate firmware update according to the information provided by the developer.