JVN#51464799
L2Blocker Sensor setup screen vulnerable to authentication bypass
Overview
The setup screen of L2Blocker Sensor contains a login authentication bypass vulnerability.
Products Affected
- L2Blocker(on-premise) Ver4.8.5 and earlier
- L2Blocker(Cloud) Ver4.8.5 and earlier
Description
L2Blocker provided by SOFTCREATE CORP. contains a vulnerability (CWE-288) in which the login authentication is bypassed by using alternative paths or channels for Sensor.
Impact
An attacker who can access the device may perform an unauthorized login and obtain the stored information or cause a malfunction of the device.
Solution
Update the Software
Update to the latest version according to the information provided by the developer.
The developer released the following version that fixes the vulnerability.
- L2Blocker Ver4.8.6
Vendor Status
| Vendor | Link |
| SOFTCREATE CORP. | Authentication bypass vulnerability in L2Blocker sensor setup screen (Text in Japanese) |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Cyber Defense Institute, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2022-33202 |
| JVN iPedia |
JVNDB-2022-000048 |