PT-2019-9266 · Toshiba · Toshiba Home Gateway Hem-Gw16A+1

Yutaka Kokubu · Published 2019-01-09 · Updated 2019-01-24 · CVE-2018-16201

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Toshiba Home gateway HEM-GW16A versions 1.2.9 and earlier Toshiba Home gateway HEM-GW26A versions 1.2.9 and earlier

Description The issue allows an attacker on the same network segment to login to the administrator's settings screen and change the configuration or execute arbitrary OS commands due to the use of hard-coded credentials.

Recommendations For Toshiba Home gateway HEM-GW16A versions 1.2.9 and earlier, consider changing the hard-coded credentials to unique and secure ones until a patch is available. For Toshiba Home gateway HEM-GW26A versions 1.2.9 and earlier, consider changing the hard-coded credentials to unique and secure ones until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-16201

Affected Products

Toshiba Home Gateway Hem-Gw16A

Toshiba Home Gateway Hem-Gw26A

References · 4

• https://osv.dev/vulnerability/CVE-2018-16201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16201 · Security Note
• http://tlt.co.jp/tlt/information/seihin/notice/defect/20181219/20181219.htm · Vendor Advisory
• https://jvn.jp/en/jp/JVN99810718/index.html · Note