JVN#19666251
Multiple vulnerabilities in OpenBlocks IoT VX2

Overview

OpenBlocks IoT VX2 provided by Plat'Home Co., Ltd. contains multiple vulnerabilities.

Products Affected

• OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series)

Description

OpenBlocks IoT VX2 provided by Plat'Home Co., Ltd. contains multiple vulnerabilities listed below.

• OS command injection (CWE-78) - CVE-2020-5535

  CVSS v3	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Base Score: 8.8
  CVSS v2	AV:A/AC:L/Au:N/C:P/I:P/A:P	Base Score: 5.8

• Improper Authentication (CWE-287) - CVE-2020-5536

  CVSS v3	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	Base Score: 5.4
  CVSS v2	AV:A/AC:L/Au:N/C:N/I:P/A:P	Base Score: 4.8

Impact

• An attacker who can access the device may execute an arbitrary OS command with root privileges - CVE-2020-5535
• An attacker who can access the device may bypass anthentication and initialize the device - CVE-2020-5536

Solution

Update the Firmware
Update to the latest version according to the information provided by the developer.