Published:2017/05/16  Last Updated:2017/05/16

FlashAir fails to restrict access permissions in PhotoShare


FlashAirTM provided by Toshiba Corporation fails to restrict access permissions in PhotoShare function.

Products Affected

  • FlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier
  • FlashAirTM SDHC Memory Card (SD-WD/WC Series <W-02>) V2.00.04 and earlier
For more details, refer to the information provided by the developer.


FlashAirTM by Toshiba Corporation is an SDHC memory card which provides wireless LAN access functions. FlashAirTM PhotoShare function enables to share the selected data with other users as it switches the original wireless LAN connection set by FlashAirTM default to the wireless LAN connection for PhotoShare.

FlashAirTM fails to restrict access permissions (CWE-425) in PhotoShare.


A user who access PhotoShare may obtain image data that are set not to be shared with other users.

Because of the vulnerability stated in JVN#81820501, when enabling PhotoShare with web browsers, an attacker with access to the wireless LAN may obtain these image data.


Update the software and configure appropriate wireless LAN setting
Update to the latest software versions of the product using the latest version of FlashAirTM Software Update tool (V3.00.02 or V2.00.04), and set SSID and password using appropriate application (either for Android or iOS) to prevent unintended accesses.
For more details, refer to the information provided by the developer.


JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Base Score: 3.5
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
Base Score: 2.7
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)


Takayoshi Isayama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Reports
CERT Advisory
CPNI Advisory
CVE CVE-2017-2161
JVN iPedia JVNDB-2017-000090