Mimosa Client における情報漏えいに関する脆弱性
| Title |
Mimosa Client における情報漏えいに関する脆弱性
|
| Summary |
Mimosa Client には、情報漏えいに関する脆弱性が存在します。
|
| Possible impacts |
情報を取得される可能性があります。 |
| Solution |
ベンダ情報および参考情報を参照して適切な対策を実施してください。 |
| Publication Date |
May 12, 2017, midnight |
| Registration Date |
June 19, 2017, 5:29 p.m. |
| Last Update |
June 19, 2017, 5:29 p.m. |
|
CVSS3.0 : 重要
|
| Score |
7.5
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
CVSS2.0 : 危険
|
| Score |
7.8
|
| Vector |
AV:N/AC:L/Au:N/C:C/I:N/A:N |
Affected System
| Mimosa Networks, Inc. |
|
Mimosa Client 2.2.3 未満
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
その他
Change Log
| No |
Changed Details |
Date of change |
| 0 |
[2017年06月19日]
掲載 |
Feb. 17, 2018, 10:37 a.m. |
NVD Vulnerability Information
CVE-2017-9136
| Summary |
An issue was discovered on Mimosa Client Radios before 2.2.3. In the device's web interface, there is a page that allows an attacker to use an unsanitized GET parameter to download files from the device as the root user. The attacker can download any file from the device's filesystem. This can be used to view unsalted, MD5-hashed administrator passwords, which can then be cracked, giving the attacker full admin access to the device's web interface. This vulnerability can also be used to view the plaintext pre-shared key (PSK) for encrypted wireless connections, or to view the device's serial number (which allows an attacker to factory reset the device).
|
| Publication Date |
May 22, 2017, 6:29 a.m. |
| Registration Date |
Jan. 26, 2021, 1:30 p.m. |
| Last Update |
Nov. 21, 2024, 12:35 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:o:mimosa:backhaul_radios:*:*:*:*:*:*:*:* |
|
2.2.1 |
|
|
| cpe:2.3:o:mimosa:client_radios:*:*:*:*:*:*:*:* |
|
2.2.1 |
|
|
Related information, measures and tools
Common Vulnerabilities List