Sign-up

ID

VAR-201707-0414


CVE

CVE-2017-2186


TITLE

HOME SPOT CUBE2 vulnerable to improper authentication in WebUI

Trust: 0.8

sources: JVNDB: JVNDB-2017-000138

DESCRIPTION

HOME SPOT CUBE2 firmware V101 and earlier allows an attacker to bypass authentication to load malicious firmware via WebUI. HOME SPOT CUBE2 provided by KDDI CORPORATION is a wireless LAN router. HOME SPOT CUBE2 contains improper authentication in WebUI. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.Firmware may be altered by an attacker who can access the management screen of the product. The WebUI is one of the graphical user interfaces. An attacker could exploit the vulnerability to bypass authentication and perform unauthorized operations. Multiple remote command injection vulnerabilities 2. A buffer-overflow vulnerability 3. Other attacks may also be possible

Trust: 2.61

sources: NVD: CVE-2017-2186 // JVNDB: JVNDB-2017-000138 // CNVD: CNVD-2017-14892 // BID: 99282 // VULHUB: VHN-110389 // VULMON: CVE-2017-2186

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-14892

AFFECTED PRODUCTS

vendor:kddimodel:home spot cube 2scope:eqversion:v100

Trust: 1.6

vendor:kddimodel:home spot cube 2scope:eqversion:v101

Trust: 1.6

vendor:kddimodel:home spot cube2scope:lteversion:v101

Trust: 0.8

vendor:kddimodel:home spot cube2scope:lteversion:<=v101

Trust: 0.6

vendor:kddimodel:home spot cubescope:eqversion:101

Trust: 0.3

vendor:kddimodel:home spot cubescope:neversion:102

Trust: 0.3

sources: CNVD: CNVD-2017-14892 // BID: 99282 // JVNDB: JVNDB-2017-000138 // CNNVD: CNNVD-201706-1113 // NVD: CVE-2017-2186

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-2186
value: HIGH

Trust: 1.0

IPA: JVNDB-2017-000138
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-14892
value: LOW

Trust: 0.6

CNNVD: CNNVD-201706-1113
value: HIGH

Trust: 0.6

VULHUB: VHN-110389
value: HIGH

Trust: 0.1

VULMON: CVE-2017-2186
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-2186
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

IPA: JVNDB-2017-000138
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:N/I:P/A:N
accessVector: ADJACENT NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2017-14892
severity: LOW
baseScore: 3.3
vectorString: AV:A/AC:L/AU:N/C:N/I:P/A:N
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.5
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-110389
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-2186
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.0

IPA: JVNDB-2017-000138
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2017-14892 // VULHUB: VHN-110389 // VULMON: CVE-2017-2186 // JVNDB: JVNDB-2017-000138 // CNNVD: CNNVD-201706-1113 // NVD: CVE-2017-2186

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.1

problemtype:CWE-264

Trust: 0.8

sources: VULHUB: VHN-110389 // JVNDB: JVNDB-2017-000138 // NVD: CVE-2017-2186

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201706-1113

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201706-1113

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-000138

PATCH
title:About Firmware update for HOME SPOT CUBE2url:https://www.au.com/information/notice_mobile/update/update-20170612-01/
Trust: 0.8
title:KDDIHOMESPOTCUBE2WebUI authentication bypass vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/98209
Trust: 0.6
title:KDDI HOME SPOT CUBE2 Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71312
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-14892 // 
            
            
            
            JVNDB: JVNDB-2017-000138 // 
            
            
            
            CNNVD: CNNVD-201706-1113

EXTERNAL IDS
db:JVNid:JVN24348065
Trust: 3.5
db:NVDid:CVE-2017-2186
Trust: 3.5
db:BIDid:99282
Trust: 2.1
db:JVNDBid:JVNDB-2017-000138
Trust: 0.8
db:CNNVDid:CNNVD-201706-1113
Trust: 0.7
db:CNVDid:CNVD-2017-14892
Trust: 0.6
db:VULHUBid:VHN-110389
Trust: 0.1
db:VULMONid:CVE-2017-2186
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-14892 // 
            
            
            
            VULHUB: VHN-110389 // 
            
            
            
            VULMON: CVE-2017-2186 // 
            
            
            
            BID: 99282 // 
            
            
            
            JVNDB: JVNDB-2017-000138 // 
            
            
            
            CNNVD: CNNVD-201706-1113 // 
            
            
            
            NVD: CVE-2017-2186

REFERENCES
url:http://jvn.jp/en/jp/jvn24348065/index.html
Trust: 2.9
url:http://www.securityfocus.com/bid/99282
Trust: 1.9
url:https://www.au.com/information/notice_mobile/update/update-20170612-01/
Trust: 1.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2186
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-2186
Trust: 0.8
url:http://jvn.jp/en/jp/jvn24348065/
Trust: 0.6
url:http://www.kddi.com/english/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/287.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-14892 // 
            
            
            
            VULHUB: VHN-110389 // 
            
            
            
            VULMON: CVE-2017-2186 // 
            
            
            
            BID: 99282 // 
            
            
            
            JVNDB: JVNDB-2017-000138 // 
            
            
            
            CNNVD: CNNVD-201706-1113 // 
            
            
            
            NVD: CVE-2017-2186

CREDITS
Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc.
Trust: 0.9
sources:
            
            
            BID: 99282 // 
            
            
            
            CNNVD: CNNVD-201706-1113

SOURCES
db:CNVDid:CNVD-2017-14892
db:VULHUBid:VHN-110389
db:VULMONid:CVE-2017-2186
db:BIDid:99282
db:JVNDBid:JVNDB-2017-000138
db:CNNVDid:CNNVD-201706-1113
db:NVDid:CVE-2017-2186

LAST UPDATE DATE
2024-11-23T22:12:59.024000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-14892date:2017-07-17T00:00:00
db:VULHUBid:VHN-110389date:2017-07-14T00:00:00
db:VULMONid:CVE-2017-2186date:2017-07-14T00:00:00
db:BIDid:99282date:2017-06-22T00:00:00
db:JVNDBid:JVNDB-2017-000138date:2018-02-14T00:00:00
db:CNNVDid:CNNVD-201706-1113date:2017-07-10T00:00:00
db:NVDid:CVE-2017-2186date:2024-11-21T03:23:03.447

SOURCES RELEASE DATE
db:CNVDid:CNVD-2017-14892date:2017-07-17T00:00:00
db:VULHUBid:VHN-110389date:2017-07-07T00:00:00
db:VULMONid:CVE-2017-2186date:2017-07-07T00:00:00
db:BIDid:99282date:2017-06-22T00:00:00
db:JVNDBid:JVNDB-2017-000138date:2017-06-21T00:00:00
db:CNNVDid:CNNVD-201706-1113date:2017-06-27T00:00:00
db:NVDid:CVE-2017-2186date:2017-07-07T13:29:00.413