Published:2018/07/02  Last Updated:2018/07/02

Multiple vulnerabilities in Calsos CSDX and CSDJ series products


Calsos CSDX and CSDJ series products contain multiple vulnerabilities.

Products Affected

  • CSDX 1.37210411 and earlier
  • CSDX(P) 4.37210411 and earlier
  • CSDX(D) 3.37210411 and earlier
  • CSDX(S) 2.37210411 and earlier
  • CSDJ-B 01.03.00 and earlier
  • CSDJ-H 01.03.00 and earlier
  • CSDJ-D 01.03.00 and earlier
  • CSDJ-A 03.00.00


Calsos CSDX and CSDJ series products provided by NEC Platforms, Ltd. contain multiple vulnerabilities listed below.

  • Access Restriction Bypass (CWE-284) - CVE-2018-0613
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score: 8.8
    CVSS v2 AV:N/AC:L/AU:S/C:P/I:P/A:P Base Score: 6.5
  • Cross-site scripting (CWE-79) - CVE-2018-0614
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
    CVSS v2 AV:N/AC:L/AU:N/C:N/I:P/A:N Base Score: 5.0


  • An arbitrary operation with administrative privilege may be performed by an attacker who logged in with the user privilege - CVE-2018-0613
  • An arbitrary script may be executed on a logged in user's web browser - CVE-2018-0614


Update the Software
Update to the latest version according to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
NEC Platforms, Ltd. Vulnerable 2018/07/02 NEC Platforms, Ltd. website


JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC


NEC Platforms, Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and NEC Platforms, Ltd. coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Reports
CERT Advisory
CPNI Advisory
CVE CVE-2018-0613
JVN iPedia JVNDB-2018-000068