Details of VAR-201803-0122

ID

VAR-201803-0122

CVE

CVE-2017-10853

TITLE

Multiple vulnerabilities in CG-WGR1200

Trust: 0.8

sources: JVNDB: JVNDB-2018-000024

DESCRIPTION

Buffer overflow in Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to execute arbitrary commands via unspecified vectors. CG-WGR1200 provided by Corega Inc is a wireless LAN router. CG-WGR1200 contains multiple vulnerabilities listed below. * Buffer Overflow (CWE-119) - CVE-2017-10852 * Buffer Overflow (CWE-78) - CVE-2017-10853 * Authentication bypass (CWE-306) - CVE-2017-10854 Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.* A user with access to the affected device may execute arbitrary code - CVE-2017-10852 * A user with access to the affected device may execute an arbitrary command - CVE-2017-10853 * A user with access to the affected device may change the login password. As a result, the user may access the management screen of the device and perform an arbitrary operation such as altering the device's settings - CVE-2017-10854

Trust: 2.25

sources: NVD: CVE-2017-10853 // JVNDB: JVNDB-2018-000024 // CNVD: CNVD-2018-04764 // VULHUB: VHN-101217

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-04764

AFFECTED PRODUCTS

vendor:	corega	model:	cg-wgr 1200	scope:	lte	version:	2.20	Trust: 1.0
vendor:	corega	model:	cg-wgr1200	scope:	lte	version:	firmware 2.20	Trust: 0.8
vendor:	corega	model:	inc cg-wgr1200	scope:	lte	version:	<=2.20	Trust: 0.6
vendor:	corega	model:	cg-wgr 1200	scope:	eq	version:	2.20	Trust: 0.6

sources: CNVD: CNVD-2018-04764 // JVNDB: JVNDB-2018-000024 // CNNVD: CNNVD-201803-322 // NVD: CVE-2017-10853

CVSS

SEVERITY

CVSSV2

CVSSV3

IPA:	JVNDB-2018-000024
value:	HIGH
Trust: 2.4
nvd@nist.gov:	CVE-2017-10853
value:	HIGH
Trust: 1.0
CNVD:	CNVD-2018-04764
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201803-322
value:	HIGH
Trust: 0.6
VULHUB:	VHN-101217
value:	HIGH
Trust: 0.1

IPA:	JVNDB-2018-000024
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 2.4
nvd@nist.gov:	CVE-2017-10853
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
CNVD:	CNVD-2018-04764
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-101217
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

IPA:	JVNDB-2018-000024
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 2.4
nvd@nist.gov:	CVE-2017-10853
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.0

sources: CNVD: CNVD-2018-04764 // VULHUB: VHN-101217 // JVNDB: JVNDB-2018-000024 // JVNDB: JVNDB-2018-000024 // JVNDB: JVNDB-2018-000024 // CNNVD: CNNVD-201803-322 // NVD: CVE-2017-10853

PROBLEMTYPE DATA

problemtype:	CWE-119	Trust: 1.1
problemtype:	CWE-78	Trust: 0.8
problemtype:	CWE-19	Trust: 0.8
problemtype:	CWE-264	Trust: 0.8

sources: VULHUB: VHN-101217 // JVNDB: JVNDB-2018-000024 // NVD: CVE-2017-10853

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201803-322

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201803-322

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-000024

PATCH

title:

Multiple vulnerabilities in CG-WGR1200

url:

http://corega.jp/support/security/20180309_wgr1200.htm

Trust: 0.8

sources: JVNDB: JVNDB-2018-000024

EXTERNAL IDS

db:	JVN	id:	JVN15201064	Trust: 3.1
db:	NVD	id:	CVE-2017-10853	Trust: 3.1
db:	JVNDB	id:	JVNDB-2018-000024	Trust: 0.8
db:	CNVD	id:	CNVD-2018-04764	Trust: 0.6
db:	CNNVD	id:	CNNVD-201803-322	Trust: 0.6
db:	VULHUB	id:	VHN-101217	Trust: 0.1

sources: CNVD: CNVD-2018-04764 // VULHUB: VHN-101217 // JVNDB: JVNDB-2018-000024 // CNNVD: CNNVD-201803-322 // NVD: CVE-2017-10853

REFERENCES

url:	https://jvn.jp/en/jp/jvn15201064/index.html	Trust: 2.5
url:	http://corega.jp/support/security/20180309_wgr1200.htm	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-10852	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-10853	Trust: 0.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-10854	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-10852	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-10853	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-10854	Trust: 0.8
url:	https://jvn.jp/en/jp/jvn15201064/	Trust: 0.6

sources: CNVD: CNVD-2018-04764 // VULHUB: VHN-101217 // JVNDB: JVNDB-2018-000024 // CNNVD: CNNVD-201803-322 // NVD: CVE-2017-10853

SOURCES

db:	CNVD	id:	CNVD-2018-04764
db:	VULHUB	id:	VHN-101217
db:	JVNDB	id:	JVNDB-2018-000024
db:	CNNVD	id:	CNNVD-201803-322
db:	NVD	id:	CVE-2017-10853

LAST UPDATE DATE

2024-11-23T21:53:21.065000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-04764	date:	2018-03-09T00:00:00
db:	VULHUB	id:	VHN-101217	date:	2018-03-27T00:00:00
db:	JVNDB	id:	JVNDB-2018-000024	date:	2018-06-14T00:00:00
db:	CNNVD	id:	CNNVD-201803-322	date:	2018-03-13T00:00:00
db:	NVD	id:	CVE-2017-10853	date:	2024-11-21T03:06:38.183

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-04764	date:	2018-03-09T00:00:00
db:	VULHUB	id:	VHN-101217	date:	2018-03-09T00:00:00
db:	JVNDB	id:	JVNDB-2018-000024	date:	2018-03-09T00:00:00
db:	CNNVD	id:	CNNVD-201803-322	date:	2018-03-13T00:00:00
db:	NVD	id:	CVE-2017-10853	date:	2018-03-09T16:29:00.283