Published:2014/12/02  Last Updated:2014/12/02

JVN#71762315
LG Electronics mobile access routers lack access restrictions

Overview

LG Electronics mobile access routers provided by NTT DOCOMO, INC. lack access restrictions.

Products Affected

  • L-09C
  • L-03E
  • L-04D

Description

LG Electronics mobile access routers provided by NTT DOCOMO, INC. lack access restrictions in the web administration interface.

Impact

An attacker that can access the device may bypass authentication and obtain information stored on the device.

Solution

Apply an Update
Apply the update according to the information provided by the provider.

Vendor Status

Vendor Status Last Update Vendor Notes
NTT DOCOMO, INC. Vulnerable 2014/12/02

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Analyzed on 2014.12.02 (CVSS Base Metrics)

What is CVSS?

Measures Severity Description
Access Vector(AV) Local (L) Adjacent Network (A) Network (N) A vulnerability exploitable with adjacent network access requires the attacker to have access to either the broadcast or collision domain of the vulnerable software.
Access Complexity(AC) High (H) Medium (M) Low (L) Specialized access conditions or extenuating circumstances do not exist.
Authentication(Au) Multiple (M) Single (S) None (N) Authentication is not required to exploit the vulnerability.
Confidentiality Impact(C) None (N) Partial (P) Complete (C) There is considerable informational disclosure. Access to some system files is possible, but the attacker does not have control over what is obtained, or the scope of the loss is constrained.
Integrity Impact(I) None (N) Partial (P) Complete (C) There is no impact to the integrity of the system.
Availability Impact(A) None (N) Partial (P) Complete (C) There is no impact to the availability of the system.

Base Score:3.3

Credit

Taiga Asano reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2014-7243
JVN iPedia JVNDB-2014-000140