Published:2012/05/25  Last Updated:2012/05/29

JVN#85934986
Logitec LAN-W300N/R series fails to restrict access permissions

Overview

Logitec LAN-W300N/R series contain an issue where access permissions are not restricted.

Products Affected

  • LAN-W300N/R firmware version 2.17

For more information, refer to the developer's website.

Description

The LAN-W300N/R series are wireless LAN routers. Logitec LAN-W300N/R series contain an issue where access permissions are not restricted.

Impact

An attacker that can access the product may log in with administrative privileges. As a result, settings may be changed or altered by the attacker who logged in to LAN-W300N/R.

Solution

Update the software
Update to the latest version according to the information provided by the developer.

References

  1. OCN
    [Important] Security Notice for Logitec wireless LAN router (Japanese only)
  2. IPA
    Security Alert for Vulnerability in LAN-W300N/R Series

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Analyzed on 2012.05.25

Measures Conditions Severity
Access Required can be attacked over the Internet using packets
  • High
Authentication a particular login or set there of is required (root, bin, etc.)
  • Low
User Interaction Required the vulnerability can be exploited without an honest user taking any action
  • High
Exploit Complexity some expertise and/or luck required (most buffer overflows, guessing correctly in small space, expertise in Windows function calls)
  • Mid-High

Description of each analysis measures

Credit

Jin Sawada, Keisuke Okazaki, Naoto Katsumi of Security Engineering Laboratory, IT Security Center(ISEC), IPA reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2012-1250
JVN iPedia JVNDB-2012-000051

Update History

2012/05/29
Information under the section "References" was added.