JVNVU#94514762
Multiple vulnerabilities in UNIMO Technology digital video recorders
Overview
Multiple digital video recorders provided by UNIMO Technology Co., Ltd contain multiple vulnerabilities.
Products Affected
- UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier
Description
Multiple digital video recorders provided by UNIMO Technology Co., Ltd contain multiple vulnerabilities listed below.
The reporter states that attacks exploiting these vulnerabilities have been observed.Impact
An arbitrary OS command may be executed on the product or the device settings may be altered.
Solution
Update the firmware
Update the firmware to the latest version according to the information provided by the developer.
This vulnerability has been addressed in the firmware version 71x10.1.107114.43A.
Vendor Status
| Vendor | Link |
| UNIMO Technology Co., Ltd | Notification Updated firmware for UDR-JA1604/UDR-JA1608/UDR-JA1616 (Text in Japanese) |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
Comment
This analysis assumes a scenario that OS commands are executed on the device using the authentication information obtained by CVE-2022-44620.
Credit
Yoshiki Mori, Ushimaru Hayato, Hiromu Kubiura and Masaki Kubo of National Institute of Information and Communications Technology Cybersecurity Research Institute reported these vulnerabilities to the developer and coordinated. After coordination was completed, this case was reported to JPCERT/CC and JPCERT/CC coordinated with the developer for the publication.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2022-44620 |
|
CVE-2022-44606 |
|
|
CVE-2022-43464 |
|
| JVN iPedia |
|