JVN#60320736
NEC PC Settings Tool vulnerable to missing authentication for critical function
Overview
PC Settings Tool provided by NEC Corporation contains a missing authentication for critical function vulnerability.
Products Affected
The following versions of PC Settings Tool Library contained in PC Settings Tool are affected by this vulnerability.
- versions 10.1.26.0 and earlier (10.x.x.x Series contained in PC Settings Tool)
- versions 11.0.22.0 and earlier (11.x.x.x Series contained in PC Settings Tool 2.0)
Description
PC Settings Tool is an application pre-installed on computers provided by NEC by default. PC Settings Tool Library contained in the application is vulnerable to missing authentication for critical function (CWE-306).
Impact
A general user of the computer which the affected product is installed may alter the registry with an administrative privilege.
Solution
Update the Software
Update the software to the followings according to the information provided by the developer.
- versions 10.1.27.0 or later (10.x.x.x Series contained in PC Settings Tool)
- versions 11.0.23.0 or later (11.x.x.x Series contained in PC Settings Tool 2.0)
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Comment
This analysis assumes that Windows registry is affected by the exploitation of this vulnerability.
Credit
Haruki Yadani of LAC Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2023-25011 |
| JVN iPedia |
JVNDB-2023-000014 |