JVN#01312667
Multiple vulnerabilities in I-O DATA WN-AX1167GR

Overview

WN-AX1167GR provided by I-O DATA DEVICE, INC. contains multiple vulnerabilities.

Products Affected

• WN-AX1167GR firmware version 3.00 and earlier

Description

WN-AX1167GR provided by I-O DATA DEVICE, INC. is a wireless LAN router.  WN-AX1167GR contains multiple vulnerabilities listed below.

• Hard-coded credentials (CWE-798) - CVE-2017-2280

  CVSS v3	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 8.8
  CVSS v2	AV:A/AC:L/Au:N/C:C/I:C/A:C	Base Score: 8.3

• OS command injection (CWE-78) - CVE-2017-2281

  CVSS v3	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 8.8
  CVSS v2	AV:A/AC:L/Au:N/C:P/I:P/A:P	Base Score: 5.8

• Buffer overflow (CWE-119) - CVE-2017-2282

  CVSS v3	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	Base Score: 6.8
  CVSS v2	AV:A/AC:L/Au:S/C:P/I:P/A:P	Base Score: 5.2

Impact

The possible impact of each vulnerability is as follows:

• A user with access to the network that is connected to the affected device may execute arbitrary code on the device  － CVE-2017-2280
• A user with access to the affected device may execute an arbitrary command － CVE-2017-2281
• If a user views a specially crafted page while logged into the affected device, an arbitrary command may be executed － CVE-2017-2282

Solution

Update the Firmware
Apply the appropriate firmware update according to the information provided by the developer.