JVN#39619137
Toshiba FlashAir does not require authentication in "Internet pass-thru Mode"
Overview
FlashAir provided by Toshiba Corporation does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled.
Products Affected
Japan
- FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later
- FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later
- FlashAir SD-WE series Class 10 model W-03
- FlashAir Class 6 model with firmware version 1.00.04 and later
- FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later
- FlashAir III Class 10 model W-03 series
- FlashAir Class 6 model with firmware version 1.00.04 and later
- FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later
- FlashAir W-03 series Class 10 model
Description
FlashAir by Toshiba Corporation is a SDHC memory card which provides "Internet pass-thru Mode", allowing devices to access the internet while connecting to FlashAir. When configured in "Internet pass-thru Mode", FlashAir acts both as a station and as an access point.
When "Internet pass-thru Mode" is enabled, FlashAir does not require authentication on accepting a connection from STA (station) side LAN.
Impact
A remote unauthenticated attacker with access to STA side LAN can obtain files or data saved in the vulnerable product.
In addition, when FlashAir III / FlashAir W-03 series is configured to access/upload files or data by WebDAV without authentication, the files and data saved in the vulnerable product can be altered or an arbitrary Lua script can be executed.
Solution
Change default settings in the configuration
Before enabling "Internet pass thru Mode", change the default settings to require authentication to the FlashAir web server.
In FlashAir API, followings are provided. Refer to the respective instructions for more information.
Vendor Status
| Vendor | Link |
| TOSHIBA CORPORATION | FlashAir Developers - Document - API Guide - CONFIG |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Tsukada Nobuhisa of Seasoft reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2016-4863 |
| JVN iPedia |
JVNDB-2016-000168 |