Search

Find a vulnerability

Search criteria

    9 vulnerabilities by softbank

    JVNDB-2026-000043

    Vulnerability from jvndb - Published: 2026-03-25 09:41 - Updated:2026-03-25 09:41
    Severity
    Summary
    SHARP routers missing authentication for some web APIs
    Details
    SHARP routers do not perform authentication for some web APIs. Those web APIs provide device information, and the initial administrative password is based on a part of the device information.
    • Missing authentication for critical function (CWE-306) - CVE-2026-32326
    Shota Zaizen reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
    Show details on JVN DB website

    {
      "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000043.html",
      "dc:date": "2026-03-25T18:41+09:00",
      "dcterms:issued": "2026-03-25T18:41+09:00",
      "dcterms:modified": "2026-03-25T18:41+09:00",
      "description": "SHARP routers do not perform authentication for some web APIs.\r\nThose web APIs provide device information, and the initial administrative password is based on a part of the device information.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/306.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eMissing authentication for critical function (CWE-306) - CVE-2026-32326\u003c/li\u003e\u003c/ul\u003eShota Zaizen reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
      "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000043.html",
      "sec:cpe": [
        {
          "#text": "cpe:/o:kddi:speed_wi-fi_5g_x01",
          "@product": "Speed Wi-Fi 5G X01",
          "@vendor": "KDDI",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/o:nttdocomo:home_5g_hr01",
          "@product": "home 5G HR01",
          "@vendor": "NTT DOCOMO, INC.",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/o:nttdocomo:home_5g_hr02",
          "@product": "home 5G HR02",
          "@vendor": "NTT DOCOMO, INC.",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/o:nttdocomo:wi-fi_station_sh-52a_firmware",
          "@product": "Wi-Fi STATION SH-52A",
          "@vendor": "NTT DOCOMO, INC.",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/o:nttdocomo:wi-fi_station_sh-52b_firmware",
          "@product": "Wi-Fi STATION SH-52B",
          "@vendor": "NTT DOCOMO, INC.",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/o:nttdocomo:wi-fi_station_sh-54c_firmware",
          "@product": "Wi-Fi STATION SH-54C",
          "@vendor": "NTT DOCOMO, INC.",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/o:softbank:5gmobile_wi-fi_router_sh-u01",
          "@product": "5G Mobile Router SH-U01",
          "@vendor": "SoftBank",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/o:softbank:pocket_wifi_5g_a503sh",
          "@product": "Pocket WiFi 5G A503SH versions",
          "@vendor": "SoftBank",
          "@version": "2.2"
        }
      ],
      "sec:cvss": {
        "@score": "5.7",
        "@severity": "Medium",
        "@type": "Base",
        "@vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
        "@version": "3.0"
      },
      "sec:identifier": "JVNDB-2026-000043",
      "sec:references": [
        {
          "#text": "https://jvn.jp/en/jp/JVN49524110/index.html",
          "@id": "JVN#49524110",
          "@source": "JVN"
        },
        {
          "#text": "https://www.cve.org/CVERecord?id=CVE-2026-32326",
          "@id": "CVE-2026-32326",
          "@source": "CVE"
        },
        {
          "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
          "@id": "CWE-Other",
          "@title": "No Mapping(CWE-Other)"
        }
      ],
      "title": "SHARP routers missing authentication for some web APIs"
    }

    JVNDB-2024-000123

    Vulnerability from jvndb - Published: 2024-11-29 06:30 - Updated:2024-11-29 06:30
    Severity
    Summary
    Multiple FCNT Android devices vulnerable to authentication bypass
    Details
    Multiple FCNT Android devices provide security features such as "privacy mode" where arbitrary applications can be set not to be displayed, etc. The devices contain an authentication bypass vulnerability (CWE-306), where, under certain conditions, the setting pages may be accessed without authentication.
    Show details on JVN DB website

    {
      "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000123.html",
      "dc:date": "2024-11-29T15:30+09:00",
      "dcterms:issued": "2024-11-29T15:30+09:00",
      "dcterms:modified": "2024-11-29T15:30+09:00",
      "description": "Multiple FCNT Android devices provide security features such as \"privacy mode\" where arbitrary applications can be set not to be displayed, etc.\r\nThe devices contain an authentication bypass vulnerability (CWE-306), where, under certain conditions, the setting pages may be accessed without authentication.",
      "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000123.html",
      "sec:cpe": [
        {
          "#text": "cpe:/o:kddi:arrows",
          "@product": "arrows",
          "@vendor": "KDDI",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/o:nttdocomo:arrows",
          "@product": "arrows",
          "@vendor": "NTT DOCOMO, INC.",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/o:nttdocomo:arrows",
          "@product": "arrows",
          "@vendor": "NTT DOCOMO, INC.",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/o:softbank:arrows",
          "@product": "arrows",
          "@vendor": "SoftBank",
          "@version": "2.2"
        }
      ],
      "sec:cvss": {
        "@score": "3.1",
        "@severity": "Low",
        "@type": "Base",
        "@vector": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
        "@version": "3.0"
      },
      "sec:identifier": "JVNDB-2024-000123",
      "sec:references": [
        {
          "#text": "https://jvn.jp/en/jp/JVN43845108/index.html",
          "@id": "JVN#43845108",
          "@source": "JVN"
        },
        {
          "#text": "https://www.cve.org/CVERecord?id=CVE-2024-53701",
          "@id": "CVE-2024-53701",
          "@source": "CVE"
        },
        {
          "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
          "@id": "CWE-Other",
          "@title": "No Mapping(CWE-Other)"
        }
      ],
      "title": "Multiple FCNT Android devices vulnerable to authentication bypass"
    }

    JVNDB-2024-012461

    Vulnerability from jvndb - Published: 2024-11-13 05:26 - Updated:2024-11-26 07:11
    Severity
    Summary
    Multiple vulnerabilities in SoftBank Mesh Wi-Fi router RP562B
    Details
    Mesh Wi-Fi router RP562B provided by SoftBank Corp. contains multiple vulnerabilities listed below. * Active debug code (CWE-489) - CVE-2024-29075 * OS command injection (CWE-78) - CVE-2024-45827 * Exposure of sensitive system information to an unauthorized control sphere (CWE-497) - CVE-2024-47799 Samy Younsi of NeroTeam Security Labs reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer.
    Impacted products
    Show details on JVN DB website

    {
      "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-012461.html",
      "dc:date": "2024-11-26T16:11+09:00",
      "dcterms:issued": "2024-11-13T14:26+09:00",
      "dcterms:modified": "2024-11-26T16:11+09:00",
      "description": "Mesh Wi-Fi router RP562B provided by SoftBank Corp. contains multiple vulnerabilities listed below.\r\n\r\n  * Active debug code (CWE-489) - CVE-2024-29075\r\n  * OS command injection (CWE-78) - CVE-2024-45827\r\n  * Exposure of sensitive system information to an unauthorized control sphere (CWE-497) - CVE-2024-47799\r\n\r\nSamy Younsi of NeroTeam Security Labs reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.",
      "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-012461.html",
      "sec:cpe": {
        "#text": "cpe:/o:softbank:mesh_wi-fi_router",
        "@product": "Mesh Wi-Fi router RP562B firmware",
        "@vendor": "SoftBank",
        "@version": "2.2"
      },
      "sec:cvss": {
        "@score": "8.0",
        "@severity": "High",
        "@type": "Base",
        "@vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
        "@version": "3.0"
      },
      "sec:identifier": "JVNDB-2024-012461",
      "sec:references": [
        {
          "#text": "https://jvn.jp/en/vu/JVNVU90676195/",
          "@id": "JVNVU#90676195",
          "@source": "JVN"
        },
        {
          "#text": "https://www.cve.org/CVERecord?id=CVE-2024-29075",
          "@id": "CVE-2024-29075",
          "@source": "CVE"
        },
        {
          "#text": "https://www.cve.org/CVERecord?id=CVE-2024-45827",
          "@id": "CVE-2024-45827",
          "@source": "CVE"
        },
        {
          "#text": "https://www.cve.org/CVERecord?id=CVE-2024-47799",
          "@id": "CVE-2024-47799",
          "@source": "CVE"
        },
        {
          "#text": "https://cwe.mitre.org/data/definitions/489.html",
          "@id": "CWE-489",
          "@title": "Active Debug Code(CWE-489)"
        },
        {
          "#text": "https://cwe.mitre.org/data/definitions/497.html",
          "@id": "CWE-497",
          "@title": "Exposure of Sensitive System Information to an Unauthorized Control Sphere(CWE-497)"
        },
        {
          "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
          "@id": "CWE-78",
          "@title": "OS Command Injection(CWE-78)"
        }
      ],
      "title": "Multiple vulnerabilities in SoftBank Mesh Wi-Fi router RP562B"
    }

    JVNDB-2022-000101

    Vulnerability from jvndb - Published: 2022-12-21 05:13 - Updated:2022-12-21 05:13
    Severity
    Summary
    +Message App improper handling of Unicode control characters
    Details
    +Message App displays text unprocessed, even when control characters are contained, and the text is shown based on Unicode control character's specifications. Therefore, a crafted text may display misleading web links (CWE-451). Akaki Tsunoda reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
    Show details on JVN DB website

    {
      "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000101.html",
      "dc:date": "2022-12-21T14:13+09:00",
      "dcterms:issued": "2022-12-21T14:13+09:00",
      "dcterms:modified": "2022-12-21T14:13+09:00",
      "description": "+Message App displays text unprocessed, even when control characters are contained, and the text is shown based on Unicode control character\u0027s specifications.\r\nTherefore, a crafted text may display misleading web links (CWE-451).\r\n\r\nAkaki Tsunoda reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
      "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000101.html",
      "sec:cpe": [
        {
          "#text": "cpe:/a:kddi:%2b_message",
          "@product": "+Message (PlusMessage)",
          "@vendor": "KDDI",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/a:nttdocomo:%2b_message",
          "@product": "+Message (PlusMessage)",
          "@vendor": "NTT DOCOMO, INC.",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/a:softbank:%2b_message",
          "@product": "+Message (PlusMessage)",
          "@vendor": "SoftBank",
          "@version": "2.2"
        }
      ],
      "sec:cvss": [
        {
          "@score": "4.3",
          "@severity": "Medium",
          "@type": "Base",
          "@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "@version": "2.0"
        },
        {
          "@score": "4.3",
          "@severity": "Medium",
          "@type": "Base",
          "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "@version": "3.0"
        }
      ],
      "sec:identifier": "JVNDB-2022-000101",
      "sec:references": [
        {
          "#text": "https://jvn.jp/en/jp/JVN43561812/index.html",
          "@id": "JVN#43561812",
          "@source": "JVN"
        },
        {
          "#text": "https://www.cve.org/CVERecord?id=CVE-2022-43543",
          "@id": "CVE-2022-43543",
          "@source": "CVE"
        },
        {
          "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-43543",
          "@id": "CVE-2022-43543",
          "@source": "NVD"
        },
        {
          "#text": "https://unicode.org/reports/tr36/",
          "@id": "Unicode Technical Report #36",
          "@source": "Related document"
        },
        {
          "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
          "@id": "CWE-Other",
          "@title": "No Mapping(CWE-Other)"
        }
      ],
      "title": "+Message App improper handling of Unicode control characters"
    }

    JVNDB-2021-000069

    Vulnerability from jvndb - Published: 2021-07-14 08:13 - Updated:2021-07-14 08:13
    Severity
    Summary
    Optical BB unit E-WMTA2.3 vulnerable to cross-site request forgery
    Details
    Optical BB unit E-WMTA2.3 provided by SoftBank contains a cross-site request forgery vulnerability (CWE-352). Hiroki Nishino reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
    Impacted products
    Show details on JVN DB website

    {
      "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000069.html",
      "dc:date": "2021-07-14T17:13+09:00",
      "dcterms:issued": "2021-07-14T17:13+09:00",
      "dcterms:modified": "2021-07-14T17:13+09:00",
      "description": "Optical BB unit E-WMTA2.3 provided by SoftBank contains a cross-site request forgery vulnerability (CWE-352).\r\n\r\nHiroki Nishino reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
      "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000069.html",
      "sec:cpe": {
        "#text": "cpe:/o:softbank:optical_bb_unit_e-wmta_firmware",
        "@product": "Optical BB unit E-WMTA",
        "@vendor": "SoftBank",
        "@version": "2.2"
      },
      "sec:cvss": [
        {
          "@score": "4.0",
          "@severity": "Medium",
          "@type": "Base",
          "@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
          "@version": "2.0"
        },
        {
          "@score": "5.4",
          "@severity": "Medium",
          "@type": "Base",
          "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
          "@version": "3.0"
        }
      ],
      "sec:identifier": "JVNDB-2021-000069",
      "sec:references": [
        {
          "#text": "https://jvn.jp/en/jp/JVN34364599/index.html",
          "@id": "JVN#34364599",
          "@source": "JVN"
        },
        {
          "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20783",
          "@id": "CVE-2021-20783",
          "@source": "CVE"
        },
        {
          "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20783",
          "@id": "CVE-2021-20783",
          "@source": "NVD"
        },
        {
          "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
          "@id": "CWE-352",
          "@title": "Cross-Site Request Forgery(CWE-352)"
        }
      ],
      "title": "Optical BB unit E-WMTA2.3 vulnerable to cross-site request forgery"
    }

    JVNDB-2018-000100

    Vulnerability from jvndb - Published: 2018-09-27 07:52 - Updated:2019-08-27 08:22
    Severity
    Summary
    +Message App fails to verify SSL server certificates
    Details
    +Message App fails to verify SSL server certificates. ma.la of LINE Corporation reported this vulnerability to the developer, and also to IPA in order to notify users of its solution through JVN. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
    Show details on JVN DB website

    {
      "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000100.html",
      "dc:date": "2019-08-27T17:22+09:00",
      "dcterms:issued": "2018-09-27T16:52+09:00",
      "dcterms:modified": "2019-08-27T17:22+09:00",
      "description": "+Message App fails to verify SSL server certificates.\r\n\r\nma.la of LINE Corporation reported this vulnerability to the developer, and also to IPA in order to notify users of its solution through JVN.\r\n JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
      "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000100.html",
      "sec:cpe": [
        {
          "#text": "cpe:/a:kddi:%2b_message",
          "@product": "+Message (PlusMessage)",
          "@vendor": "KDDI",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/a:nttdocomo:%2b_message",
          "@product": "+Message (PlusMessage)",
          "@vendor": "NTT DOCOMO, INC.",
          "@version": "2.2"
        },
        {
          "#text": "cpe:/a:softbank:%2b_message",
          "@product": "+Message (PlusMessage)",
          "@vendor": "SoftBank",
          "@version": "2.2"
        }
      ],
      "sec:cvss": [
        {
          "@score": "4.0",
          "@severity": "Medium",
          "@type": "Base",
          "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
          "@version": "2.0"
        },
        {
          "@score": "4.8",
          "@severity": "Medium",
          "@type": "Base",
          "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "@version": "3.0"
        }
      ],
      "sec:identifier": "JVNDB-2018-000100",
      "sec:references": [
        {
          "#text": "https://jvn.jp/en/jp/JVN37288228/",
          "@id": "JVN#37288228",
          "@source": "JVN"
        },
        {
          "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0691",
          "@id": "CVE-2018-0691",
          "@source": "CVE"
        },
        {
          "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-0691",
          "@id": "CVE-2018-0691",
          "@source": "NVD"
        },
        {
          "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
          "@id": "CWE-Other",
          "@title": "No Mapping(CWE-Other)"
        }
      ],
      "title": "+Message App fails to verify SSL server certificates"
    }

    JVNDB-2017-000080

    Vulnerability from jvndb - Published: 2017-05-12 04:36 - Updated:2017-11-27 07:55
    Severity
    Summary
    PrimeDrive Desktop Application Installer may insecurely load executable files
    Details
    PrimeDrive Desktop Application is the client application for PrimeDrive online storage service provided by SoftBank Corp. The installer of PrimeDrive Desktop Application contains an issue with the file search path, which may insecurely load executable files (CWE-427). Eili Masami of Tachibana Lab. and Eiji James Yoshida of Security Professionals Network Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
    Impacted products
    Show details on JVN DB website

    {
      "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000080.html",
      "dc:date": "2017-11-27T16:55+09:00",
      "dcterms:issued": "2017-05-12T13:36+09:00",
      "dcterms:modified": "2017-11-27T16:55+09:00",
      "description": "PrimeDrive Desktop Application is the client application for PrimeDrive online storage service provided by SoftBank Corp. The installer of PrimeDrive Desktop Application contains an issue with the file search path, which may insecurely load executable files (CWE-427).\r\n\r\nEili Masami of Tachibana Lab. and Eiji James Yoshida of Security Professionals Network Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
      "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000080.html",
      "sec:cpe": {
        "#text": "cpe:/a:softbank:primedrive_desktop_application",
        "@product": "PrimeDrive Desktop Application",
        "@vendor": "SoftBank",
        "@version": "2.2"
      },
      "sec:cvss": [
        {
          "@score": "6.8",
          "@severity": "Medium",
          "@type": "Base",
          "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "@version": "2.0"
        },
        {
          "@score": "7.8",
          "@severity": "High",
          "@type": "Base",
          "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "@version": "3.0"
        }
      ],
      "sec:identifier": "JVNDB-2017-000080",
      "sec:references": [
        {
          "#text": "http://jvn.jp/en/jp/JVN16248227/index.html",
          "@id": "JVN#16248227",
          "@source": "JVN"
        },
        {
          "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2167",
          "@id": "CVE-2017-2167",
          "@source": "CVE"
        },
        {
          "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2167",
          "@id": "CVE-2017-2167",
          "@source": "NVD"
        },
        {
          "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
          "@id": "CWE-Other",
          "@title": "No Mapping(CWE-Other)"
        }
      ],
      "title": "PrimeDrive Desktop Application Installer may insecurely load executable files"
    }

    JVNDB-2017-000033

    Vulnerability from jvndb - Published: 2017-03-01 06:53 - Updated:2017-05-15 02:27
    Severity
    Summary
    PrimeDrive Desktop Application Installer may insecurely load Dynamic Link Libraries
    Details
    PrimeDrive Desktop Application is the client application for PrimeDrive online storage service provided by SoftBank Corp. The installer of PrimeDrive Desktop Application is vulnerable to load specific Dynamic Link Libraries in the same directory (CWE-427) . Eiji James Yoshida of Security Professionals Network Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
    Impacted products
    Show details on JVN DB website

    {
      "@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000033.html",
      "dc:date": "2017-05-15T11:27+09:00",
      "dcterms:issued": "2017-03-01T15:53+09:00",
      "dcterms:modified": "2017-05-15T11:27+09:00",
      "description": "PrimeDrive Desktop Application is the client application for PrimeDrive online storage service provided by SoftBank Corp. The installer of PrimeDrive Desktop Application is vulnerable to load specific Dynamic Link Libraries in the same directory (CWE-427) .\r\n\r\nEiji James Yoshida of Security Professionals Network Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
      "link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000033.html",
      "sec:cpe": {
        "#text": "cpe:/a:softbank:primedrive_desktop_application",
        "@product": "PrimeDrive Desktop Application",
        "@vendor": "SoftBank",
        "@version": "2.2"
      },
      "sec:cvss": [
        {
          "@score": "6.8",
          "@severity": "Medium",
          "@type": "Base",
          "@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "@version": "2.0"
        },
        {
          "@score": "7.8",
          "@severity": "High",
          "@type": "Base",
          "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "@version": "3.0"
        }
      ],
      "sec:identifier": "JVNDB-2017-000033",
      "sec:references": [
        {
          "#text": "http://jvn.jp/en/jp/JVN88713190/index.html",
          "@id": "JVN#88713190",
          "@source": "JVN"
        },
        {
          "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2108",
          "@id": "CVE-2017-2108",
          "@source": "CVE"
        },
        {
          "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2108",
          "@id": "CVE-2017-2108",
          "@source": "NVD"
        },
        {
          "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
          "@id": "CWE-Other",
          "@title": "No Mapping(CWE-Other)"
        }
      ],
      "title": "PrimeDrive Desktop Application Installer may insecurely load Dynamic Link Libraries"
    }

    CVE-2021-20783 (GCVE-0-2021-20783)

    Vulnerability from cvelistv5 – Published: 2021-07-28 00:45 – Updated: 2024-08-03 17:53
    VLAI
    Summary
    Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of administrators via a specially crafted page.
    Severity
    No CVSS data available.
    CWE
    • Cross-site request forgery
    Assigner
    jpcert CNA
    References
    Impacted products
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T17:53:22.630Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://jvn.jp/en/jp/JVN34364599/index.html"
              }
            ],
            "title": "CVE Program Container"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Optical BB unit E-WMTA2.3",
              "vendor": "SoftBank",
              "versions": [
                {
                  "status": "affected",
                  "version": "all versions"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of administrators via a specially crafted page."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "Cross-site request forgery",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2021-07-28T00:45:24.000Z",
            "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
            "shortName": "jpcert"
          },
          "references": [
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://jvn.jp/en/jp/JVN34364599/index.html"
            }
          ],
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "vultures@jpcert.or.jp",
              "ID": "CVE-2021-20783",
              "STATE": "PUBLIC"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "Optical BB unit E-WMTA2.3",
                          "version": {
                            "version_data": [
                              {
                                "version_value": "all versions"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "SoftBank"
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of administrators via a specially crafted page."
                }
              ]
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "Cross-site request forgery"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "https://jvn.jp/en/jp/JVN34364599/index.html",
                  "refsource": "MISC",
                  "url": "https://jvn.jp/en/jp/JVN34364599/index.html"
                }
              ]
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "assignerShortName": "jpcert",
        "cveId": "CVE-2021-20783",
        "datePublished": "2021-07-28T00:45:24.000Z",
        "dateReserved": "2020-12-17T00:00:00.000Z",
        "dateUpdated": "2024-08-03T17:53:22.630Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }