CVE-2016-7807

I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devices inserted into the product via unspecified vectors.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.iodata.jp/support/information/2016/wfs-sr01/	Patch Vendor Advisory
http://www.securityfocus.com/bid/94089	Third Party Advisory VDB Entry
https://jvn.jp/en/jp/JVN18228200/index.html	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:iodata:wfs-sr01_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:iodata:wfs-sr01:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-06-09 16:29

Updated : 2017-06-15 19:32

NVD link : CVE-2016-7807

Mitre link : CVE-2016-7807

CVE.ORG link : CVE-2016-7807

JSON object : View

Products Affected

iodata

wfs-sr01
wfs-sr01_firmware

CWE

CWE-284

Improper Access Control

{"id": "CVE-2016-7807", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-06-09T16:29:00.517", "references": [{"url": "http://www.iodata.jp/support/information/2016/wfs-sr01/", "tags": ["Patch", "Vendor Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "http://www.securityfocus.com/bid/94089", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN18228200/index.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devices inserted into the product via unspecified vectors."}, {"lang": "es", "value": "El dispositivo I-O DATA WFS-SR01 con firmware 1.10 y anteriores del permite a los atacantes remotos evitar la restricci\u00f3n de acceso para acceder a los datos de los dispositivos de almacenamiento insertados en el producto a trav\u00e9s de vectores no especificados"}], "lastModified": "2017-06-15T19:32:41.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:iodata:wfs-sr01_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11AF63E4-A7F2-46B9-B539-2D41B33E60E4", "versionEndIncluding": "1.10"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:iodata:wfs-sr01:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "47B1096E-2012-4BD4-8F43-6CAF7769C150"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vultures@jpcert.or.jp"}