Published:2016/06/22 Last Updated:2016/06/22
JVN#76653039
CG-WLBARGL vulnerable to command injection
Overview
CG-WLBARGL contains a command injection vulnerability.
Products Affected
- CG-WLBARGL
Description
CG-WLBARGL provided by Corega Inc is a wireless LAN router. CG-WLBARGL contains a command injection vulnerability.
Impact
An arbitrary command may be executed by an authenticated attacker.
Solution
Do not use CG-WLBARGL
As of Jun 22nd, 2016, there are no practical solutions to this issue.
It is recommended to stop using CG-WLBARGL according to the information provided by the developer.
Vendor Status
| Vendor | Link |
| Corega Inc | About command injection vulnerability |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
CVSS v3
CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Base Score:
4.3
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
CVSS v2
AV:A/AC:L/Au:S/C:P/I:P/A:P
Base Score:
5.2
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Comment
This analysis assumes the product being accessed by an attacker in the same segment of the LAN side.
Credit
Ohji Kashiwazaki of Global Security Experts Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2016-4822 |
| JVN iPedia |
JVNDB-2016-000107 |