JVN#45473612
Multiple vulnerabilities in CentreCOM AR260S V2

Overview

CentreCOM AR260S V2 provided by Allied Telesis K.K. contains multiple vulnerabilities.

Products Affected

• CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7

Description

CentreCOM AR260S V2 provided by Allied Telesis K.K. contains multiple vulnerabilities listed below.

• OS command injection vulnerability in GUI setting page (CWE-78) - CVE-2022-35273

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Base Score: 8.8
  CVSS v2	AV:N/AC:L/Au:S/C:C/I:C/A:C	Base Score: 9.0

• Use of hard-coded credentials for the telnet server (CWE-798) - CVE-2022-38394

  CVSS v3	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 8.1
  CVSS v2	AV:N/AC:M/Au:N/C:C/I:C/A:C	Base Score: 9.3

• Undocumented hidden command that can be excuted from the telnet function (CWE-912) - CVE-2022-34869

  CVSS v3	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Base Score: 7.5
  CVSS v2	AV:N/AC:H/Au:S/C:C/I:C/A:C	Base Score: 7.1

• OS command injection vulnerability in the telnet function (CWE-78) - CVE-2022-38094

  CVSS v3	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Base Score: 7.5
  CVSS v2	AV:N/AC:H/Au:S/C:C/I:C/A:C	Base Score: 7.1

Impact

A remote attacker may execute an arbitrary OS command.

Solution

Update the firmware and Change passwords
Update the firmware to the latest version according to the information provided by the developer, and then change all passwords including "guest" account passwords.

Apply the workaround
Applying the following workarounds may mitigate the impacts of these vulnerabilities.

• Enable the Firewall protection
• Change all passwords including "guest" account passwords