Published:2015/12/25  Last Updated:2015/12/25

JVN#51349622
CG-WLBARGS does not properly perform authentication

Overview

CG-WLBARGS does not properly perform authentication.

Products Affected

  • CG-WLBARGS

Description

CG-WLBARGS provided by Corega Inc is a wireless LAN router. CG-WLBARGS does not properly perform authentication.

Impact

An attacker who can access the product may log in with administrative privileges. As a result, an arbitrary administrative operations may be executed.

Solution

Apply a Workaround
The following workarounds may mitigate the affects of this vulnerability.

  • Disable the remote access function to avoid access to the product from the internet
  • Encrypt wireless LAN communications to avoid access to the product from adjacent networks
Note that these workarounds above do not prevent access from wired local networks.

Vendor Status

Vendor Link
Corega Inc About the authentication flaw

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 9.8
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:N/AC:L/Au:N/C:C/I:C/A:C
Base Score: 10.0
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Credit

Kousuke Kawahira of DWANGO Co.,Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2015-7792
JVN iPedia JVNDB-2015-000201