Multiple I-O DATA Network Camera Products CVE-2017-2223 Cross Site Request Forgery Vulnerability

Bugtraq ID:	99144
Class:	Input Validation Error
CVE:	CVE-2017-2223
Remote:	Yes
Local:	No
Published:	Jun 20 2017 12:00AM
Updated:	Jun 20 2017 12:00AM
Credit:	Takayoshi Isayama
Vulnerable:	I-O DATA DEVICE INC TS-WRLC 1.19 I-O DATA DEVICE INC TS-WPTCAM2 1.19 I-O DATA DEVICE INC TS-WPTCAM 1.19 I-O DATA DEVICE INC TS-WLCE 1.19 I-O DATA DEVICE INC TS-WLC2 1.19 I-O DATA DEVICE INC TS-PTCAM/POE 1.19 I-O DATA DEVICE INC TS-PTCAM 1.19
Not Vulnerable:

Multiple I-O DATA Network Camera Products CVE-2017-2223 Cross Site Request Forgery Vulnerability

Multiple I-O DATA Network Camera Products are prone to cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

The following products are affected:

TS-WPTCAM firmware version 1.19 and prior.
TS-WPTCAM2 firmware version 1.19 and prior.
TS-PTCAM firmware version 1.19 and prior.
TS-PTCAM/POE firmware version 1.19 and prior.
TS-WLC2 firmware version 1.19 and prior.
TS-WLCE firmware version 1.19 and prior.
TS-WRLC firmware version 1.19 and prior.

Multiple I-O DATA Network Camera Products CVE-2017-2223 Cross Site Request Forgery Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple I-O DATA Network Camera Products CVE-2017-2223 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple I-O DATA Network Camera Products CVE-2017-2223 Cross Site Request Forgery Vulnerability

References:

• I-O DATA Homepage (I-O DATA DEVICE)
  
• JVN#65411235: Multiple I-O DATA network camera products vulnerable to cross-site (JP-CERT)