Published:2020/04/08  Last Updated:2020/04/08

JVN#89224521
Multiple vulnerabilities in EasyBlocks IPv6

Overview

EasyBlocks IPv6 provided by Plat'Home Co., Ltd. contains multiple vulnerabilities.

Products Affected

  • EasyBlocks IPv6 Ver. 2.0.1 and earlier
  • EasyBlocks IPv6 Enterprise Ver. 2.0.1 and earlier

Description

EasyBlocks IPv6 provided by Plat'Home Co., Ltd. contains multiple vulnerabilities listed below.

  • Cross site request forgery(CWE-352) - CVE-2020-5549
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N Base Score: 2.6
  • Session fixation (CWE-384) - CVE-2020-5550
    CVSS v3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Base Score: 4.2
    CVSS v2 AV:N/AC:H/Au:N/C:P/I:P/A:N Base Score: 4.0

Impact

  • If a user views a malicious page while logged in the management console, unintended operations may be performed - CVE-2020-5549
  • A remote attacker impersonating a registered user may log in the management console. As a result, information may be altered/disclosed. - CVE-2020-5550

Solution

Update the Firmware
Update to the latest version according to the information provided by the developer.

Apply a Workaround
Blocking access from untrusted network or host to port 880 may mitigate the impacts of this vulnerability.

Vendor Status

Vendor Status Last Update Vendor Notes
Plat'Home Co.,Ltd. Vulnerable 2020/04/08

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Hideki SAKAMOTO of Tsukuba Secure Network Research reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2020-5549
CVE-2020-5550
JVN iPedia JVNDB-2020-000022