Published:2016/10/07  Last Updated:2016/10/07

JVN#39619137
Toshiba FlashAir does not require authentication in "Internet pass-thru Mode"

Overview

FlashAir provided by Toshiba Corporation does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled.

Products Affected

Japan

  • FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later
  • FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later
  • FlashAir SD-WE series Class 10 model W-03
USA
  • FlashAir Class 6 model with firmware version 1.00.04 and later
  • FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later
  • FlashAir III Class 10 model W-03 series
Countries & Regions except Japan and USA
  • FlashAir Class 6 model with firmware version 1.00.04 and later
  • FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later
  • FlashAir W-03 series Class 10 model

Description

FlashAir by Toshiba Corporation is a SDHC memory card which provides "Internet pass-thru Mode", allowing devices to access the internet while connecting to FlashAir. When configured in "Internet pass-thru Mode", FlashAir acts both as a station and as an access point.
When "Internet pass-thru Mode" is enabled, FlashAir does not require authentication on accepting a connection from STA (station) side LAN.

Impact

A remote unauthenticated attacker with access to STA side LAN can obtain files or data saved in the vulnerable product.
In addition, when FlashAir III / FlashAir W-03 series is configured to access/upload files or data by WebDAV without authentication, the files and data saved in the vulnerable product can be altered or an arbitrary Lua script can be executed.

Solution

Change default settings in the configuration
Before enabling "Internet pass thru Mode", change the default settings to require authentication to the FlashAir web server.
In FlashAir API, followings are provided. Refer to the respective instructions for more information.

Vendor Status

Vendor Link
TOSHIBA CORPORATION FlashAir Developers - Document - API Guide - CONFIG

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score: 5.0
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:A/AC:M/Au:N/C:P/I:P/A:P
Base Score: 5.4
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Credit

Tsukada Nobuhisa of Seasoft reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2016-4863
JVN iPedia JVNDB-2016-000168