HOME SPOT CUBE2 Multiple Security Vulnerabilities

Bugtraq ID:	99282
Class:	Input Validation Error
CVE:	CVE-2017-2183 CVE-2017-2184 CVE-2017-2185 CVE-2017-2186
Remote:	Yes
Local:	No
Published:	Jun 22 2017 12:00AM
Updated:	Jun 22 2017 12:00AM
Credit:	Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc.
Vulnerable:	KDDI CORPORATION HOME SPOT CUBE 101
Not Vulnerable:	KDDI CORPORATION HOME SPOT CUBE 102

HOME SPOT CUBE2 Multiple Security Vulnerabilities

HOME SPOT CUBE2 is prone to following security vulnerabilities:

1. Multiple remote command injection vulnerabilities
2. A buffer-overflow vulnerability
3. An authentication bypass vulnerability

Attackers can exploit these issues to execute arbitrary commands,to execute arbitrary code in context of the application, or bypass the authentication mechanism and perform unauthorized actions. Other attacks may also be possible.

HOME SPOT CUBE2 firmware version 101 and earlier are vulnerable.

HOME SPOT CUBE2 Multiple Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HOME SPOT CUBE2 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

HOME SPOT CUBE2 Multiple Security Vulnerabilities

References:

• KDDI Homepage (KDDI)
  
• JVN#24348065:Multiple vulnerabilities in HOME SPOT CUBE2 (JPCERT)