« Volver al listado

CVE-2016-4863

Estado: ModificadaMedia (4.3)—

The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later, FlashAir III Class 10 model W-03 series, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later, FlashAir W-03 series Class 10 model does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled, which allows attackers with access to STA side LAN can obtain files or data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Toshiba — Flashair

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-4863",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.3,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Toshiba",
          "product": "FlashAir SD-WD/WC series Class 6 model",
          "versions": [
            {
              "status": "affected",
              "version": "firmware version 1.00.04 and later"
            }
          ]
        },
        {
          "vendor": "Toshiba",
          "product": "FlashAir SD-WD/WC series Class 10 model W-02",
          "versions": [
            {
              "status": "affected",
              "version": "firmware version 2.00.02 and later"
            }
          ]
        },
        {
          "vendor": "Toshiba",
          "product": "FlashAir SD-WE series Class 10 model W-03",
          "versions": [
            {
              "status": "affected",
              "version": "all firmware versions"
            }
          ]
        },
        {
          "vendor": "Toshiba",
          "product": "FlashAir Class 6 model",
          "versions": [
            {
              "status": "affected",
              "version": "firmware version 1.00.04 and later"
            }
          ]
        },
        {
          "vendor": "Toshiba",
          "product": "FlashAir II Class 10 model W-02 series",
          "versions": [
            {
              "status": "affected",
              "version": "firmware version 2.00.02 and later"
            }
          ]
        },
        {
          "vendor": "Toshiba",
          "product": "FlashAir III Class 10 model W-03 series",
          "versions": [
            {
              "status": "affected",
              "version": "all firmware versions"
            }
          ]
        },
        {
          "vendor": "Toshiba",
          "product": "FlashAir Class 6 model",
          "versions": [
            {
              "status": "affected",
              "version": "firmware version 1.00.04 and later"
            }
          ]
        },
        {
          "vendor": "Toshiba",
          "product": "FlashAir W-02 series Class 10 model",
          "versions": [
            {
              "status": "affected",
              "version": "firmware version 2.00.02 and later"
            }
          ]
        },
        {
          "vendor": "Toshiba",
          "product": "FlashAir W-03 series Class 10 model",
          "versions": [
            {
              "status": "affected",
              "version": "all firmware versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-05-22T16:29:00.217",
  "references": [
    {
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000168",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://www.securityfocus.com/bid/93479",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN39619137/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000168",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/93479",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN39619137/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later, FlashAir III Class 10 model W-03 series, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later, FlashAir W-03 series Class 10 model does not require authentication on accepting a connection from STA side LAN when \"Internet pass-thru Mode\" is enabled, which allows attackers with access to STA side LAN can obtain files or data."
    },
    {
      "lang": "es",
      "value": "El FlashAir SD-WD/WC serie Clase 6  modelo con versión de firmware 1.00.04 y posterior, FlashAir SD- WD/WC serie Clase 10 modelo W-02 con versión de firmware  2.00.02 y posterior, FlashAir SD-WE serie Clase 10 modelo W-03, FlashAir Clase 6 modelo con versión de firmware 1.00.04 y posterior, FlashAir II Clase 10 modelo W-02 serie con versión de firmware  2.00.02 y posterior, FlashAir III Clase 10 modelo W-03 serie, FlashAir Clase 6 modelo con versión de firmware  1.00.04 y posterior, FlashAir W-02 serie Clase 10 modelo con versión de firmware  2.00.02 y posterior,  FlashAir W-03 serie clase 10 el modelo de Toshiba,  no requieren la autenticación al aceptar una conexión de LAN del lado STA cuando se habilita el \"Internet pass-thru Mode\", que permite que los atacantes con acceso a LAN del lado STA puedan obtener archivos o datos."
    }
  ],
  "lastModified": "2026-06-17T00:48:21.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:toshiba:flashair:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBA7647D-DB43-4DD7-89B4-02CD310B8F5B",
              "versionEndIncluding": "1.00.03"
            },
            {
              "criteria": "cpe:2.3:a:toshiba:flashair:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3E68A5E-C899-484D-87EA-F52414B66968",
              "versionEndIncluding": "1.00.04"
            },
            {
              "criteria": "cpe:2.3:a:toshiba:flashair:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8288D17C-1CE9-4B38-81C4-9C702E5800D9",
              "versionEndIncluding": "1.00.06"
            },
            {
              "criteria": "cpe:2.3:a:toshiba:flashair:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C0CE8592-61C3-4F18-9398-3F9C2F5531A4",
              "versionEndIncluding": "1.02"
            },
            {
              "criteria": "cpe:2.3:a:toshiba:flashair:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7DB5458-E52B-497D-8B09-040FCDB13B78",
              "versionEndIncluding": "2.00.03"
            },
            {
              "criteria": "cpe:2.3:a:toshiba:flashair:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48762E2F-044E-43C6-8221-FBFBA9C8E7E4",
              "versionEndIncluding": "3.00.01"
            },
            {
              "criteria": "cpe:2.3:a:toshiba:flashair:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C182FF61-0D00-4AE6-94CD-38BBB47050D5",
              "versionEndIncluding": "3.0.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}