Published:2017/07/19  Last Updated:2017/07/19

JVN#14151222
Multiple vulnerabilities SONY Portable Wireless Server WG-C10

Overview

Portable Wireless Server WG-C10 provided by Sony Corporation contains multiple vulnerabilities.

Products Affected

  • WG-C10 v3.0.79 and earlier

Description

Portable Wireless Server WG-C10 provided by Sony Corporation contains multiple vulnerabilities listed below.

  • OS command injection (CWE-78) - CVE-2017-2275
    CVSS v3 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score: 6.8
    CVSS v2 AV:A/AC:L/Au:S/C:P/I:P/A:P Base Score: 5.2
  • Buffer overflow (CWE-119) - CVE-2017-2276
    CVSS v3 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score: 6.8
    CVSS v2 AV:A/AC:L/Au:S/C:P/I:P/A:P Base Score: 5.2

Impact

An attacker who can log in to the product as an administrator may execute arbitrary OS commands.

Solution

Apply a Workaround
The following workarounds may mitigate the affects of this vulnerability.

  • Set up wireless LAN password and access password.
For more information, please refer to the developer's website.

Vendor Status

Vendor Status Last Update Vendor Notes
Sony Corporation Vulnerable 2017/07/19 Sony Corporation website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2017-2275
CVE-2017-2276
JVN iPedia JVNDB-2017-000175