PT-2019-9266 · Toshiba · Toshiba Home Gateway Hem-Gw16A+1

Yutaka Kokubu · Publicado 2019-01-09 · Atualizado 2019-01-24 · CVE-2018-16201

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Toshiba Home gateway HEM-GW16A versions 1.2.9 and earlier Toshiba Home gateway HEM-GW26A versions 1.2.9 and earlier

Description The issue allows an attacker on the same network segment to login to the administrator's settings screen and change the configuration or execute arbitrary OS commands due to the use of hard-coded credentials.

Recommendations For Toshiba Home gateway HEM-GW16A versions 1.2.9 and earlier, consider changing the hard-coded credentials to unique and secure ones until a patch is available. For Toshiba Home gateway HEM-GW26A versions 1.2.9 and earlier, consider changing the hard-coded credentials to unique and secure ones until a patch is available.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-16201

Produtos afetados

Toshiba Home Gateway Hem-Gw16A

Toshiba Home Gateway Hem-Gw26A

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-16201 · Aviso do Fabricante
• https://jvn.jp/en/jp/JVN99810718/index.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16201 · Nota de Segurança
• http://tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm · Aviso do Fabricante