Published:2016/06/22  Last Updated:2016/06/22

JVN#76653039
CG-WLBARGL vulnerable to command injection

Overview

CG-WLBARGL contains a command injection vulnerability.

Products Affected

  • CG-WLBARGL

Description

CG-WLBARGL provided by Corega Inc is a wireless LAN router. CG-WLBARGL contains a command injection vulnerability.

Impact

An arbitrary command may be executed by an authenticated attacker.

Solution

Do not use CG-WLBARGL
As of Jun 22nd, 2016, there are no practical solutions to this issue.
It is recommended to stop using CG-WLBARGL according to the information provided by the developer.

Vendor Status

Vendor Link
Corega Inc About command injection vulnerability

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Base Score: 4.3
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:A/AC:L/Au:S/C:P/I:P/A:P
Base Score: 5.2
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Comment

This analysis assumes the product being accessed by an attacker in the same segment of the LAN side.

Credit

Ohji Kashiwazaki of Global Security Experts Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2016-4822
JVN iPedia JVNDB-2016-000107