PT-2017-8560 · Toshiba · Toshiba Flashair Sd-Wd/Wc Series Class 6+4

Tsukada Nobuhisa · Published 2017-05-22 · Updated 2017-06-12 · CVE-2016-4863

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Toshiba FlashAir SD-WD/WC series Class 6 model version 1.00.04 and later Toshiba FlashAir SD-WD/WC series Class 10 model W-02 version 2.00.02 and later Toshiba FlashAir SD-WE series Class 10 model W-03 Toshiba FlashAir II Class 10 model W-02 series version 2.00.02 and later Toshiba FlashAir III Class 10 model W-03 series Toshiba FlashAir W-02 series Class 10 model version 2.00.02 and later Toshiba FlashAir W-03 series Class 10 model

Description The issue allows attackers with access to the STA side LAN to obtain files or data when "Internet pass-thru Mode" is enabled, as no authentication is required for accepting connections.

Recommendations For Toshiba FlashAir SD-WD/WC series Class 6 model version 1.00.04 and later, consider disabling "Internet pass-thru Mode" until a patch is available. For Toshiba FlashAir SD-WD/WC series Class 10 model W-02 version 2.00.02 and later, restrict access to the LAN to minimize the risk of exploitation. For Toshiba FlashAir SD-WE series Class 10 model W-03, avoid using "Internet pass-thru Mode" until the issue is resolved. For Toshiba FlashAir II Class 10 model W-02 series version 2.00.02 and later, restrict access to the STA side LAN to prevent unauthorized access. For Toshiba FlashAir III Class 10 model W-03 series, consider implementing additional authentication measures for the "Internet pass-thru Mode". For Toshiba FlashAir W-02 series Class 10 model version 2.00.02 and later, disable "Internet pass-thru Mode" as a temporary workaround. For Toshiba FlashAir W-03 series Class 10 model, restrict access to the "Internet pass-thru Mode" feature until a fix is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2016-4863

Affected Products

Toshiba Flashair Ii Class 10

Toshiba Flashair Sd-Wd/Wc Series Class 10

Toshiba Flashair Sd-Wd/Wc Series Class 6

Toshiba Flashair W-02 Series Class 10

Toshiba Flashair W-03 Series Class 10

References · 5

• https://osv.dev/vulnerability/CVE-2016-4863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4863 · Security Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2016-000168 · Note
• http://securityfocus.com/bid/93479 · Note
• https://jvn.jp/en/jp/JVN39619137/index.html · Note