Search
Find a vulnerability
Search criteria
9 vulnerabilities by softbank
JVNDB-2026-000043
Vulnerability from jvndb - Published: 2026-03-25 09:41 - Updated:2026-03-25 09:41
Severity
Summary
SHARP routers missing authentication for some web APIs
Details
SHARP routers do not perform authentication for some web APIs.
Those web APIs provide device information, and the initial administrative password is based on a part of the device information.
- Missing authentication for critical function (CWE-306) - CVE-2026-32326
References
| Type | URL | |
|---|---|---|
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000043.html",
"dc:date": "2026-03-25T18:41+09:00",
"dcterms:issued": "2026-03-25T18:41+09:00",
"dcterms:modified": "2026-03-25T18:41+09:00",
"description": "SHARP routers do not perform authentication for some web APIs.\r\nThose web APIs provide device information, and the initial administrative password is based on a part of the device information.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/306.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eMissing authentication for critical function (CWE-306) - CVE-2026-32326\u003c/li\u003e\u003c/ul\u003eShota Zaizen reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000043.html",
"sec:cpe": [
{
"#text": "cpe:/o:kddi:speed_wi-fi_5g_x01",
"@product": "Speed Wi-Fi 5G X01",
"@vendor": "KDDI",
"@version": "2.2"
},
{
"#text": "cpe:/o:nttdocomo:home_5g_hr01",
"@product": "home 5G HR01",
"@vendor": "NTT DOCOMO, INC.",
"@version": "2.2"
},
{
"#text": "cpe:/o:nttdocomo:home_5g_hr02",
"@product": "home 5G HR02",
"@vendor": "NTT DOCOMO, INC.",
"@version": "2.2"
},
{
"#text": "cpe:/o:nttdocomo:wi-fi_station_sh-52a_firmware",
"@product": "Wi-Fi STATION SH-52A",
"@vendor": "NTT DOCOMO, INC.",
"@version": "2.2"
},
{
"#text": "cpe:/o:nttdocomo:wi-fi_station_sh-52b_firmware",
"@product": "Wi-Fi STATION SH-52B",
"@vendor": "NTT DOCOMO, INC.",
"@version": "2.2"
},
{
"#text": "cpe:/o:nttdocomo:wi-fi_station_sh-54c_firmware",
"@product": "Wi-Fi STATION SH-54C",
"@vendor": "NTT DOCOMO, INC.",
"@version": "2.2"
},
{
"#text": "cpe:/o:softbank:5gmobile_wi-fi_router_sh-u01",
"@product": "5G Mobile Router SH-U01",
"@vendor": "SoftBank",
"@version": "2.2"
},
{
"#text": "cpe:/o:softbank:pocket_wifi_5g_a503sh",
"@product": "Pocket WiFi 5G A503SH versions",
"@vendor": "SoftBank",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "5.7",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2026-000043",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN49524110/index.html",
"@id": "JVN#49524110",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-32326",
"@id": "CVE-2026-32326",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "SHARP routers missing authentication for some web APIs"
}
JVNDB-2024-000123
Vulnerability from jvndb - Published: 2024-11-29 06:30 - Updated:2024-11-29 06:30
Severity
Summary
Multiple FCNT Android devices vulnerable to authentication bypass
Details
Multiple FCNT Android devices provide security features such as "privacy mode" where arbitrary applications can be set not to be displayed, etc.
The devices contain an authentication bypass vulnerability (CWE-306), where, under certain conditions, the setting pages may be accessed without authentication.
References
| Type | URL | |
|---|---|---|
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000123.html",
"dc:date": "2024-11-29T15:30+09:00",
"dcterms:issued": "2024-11-29T15:30+09:00",
"dcterms:modified": "2024-11-29T15:30+09:00",
"description": "Multiple FCNT Android devices provide security features such as \"privacy mode\" where arbitrary applications can be set not to be displayed, etc.\r\nThe devices contain an authentication bypass vulnerability (CWE-306), where, under certain conditions, the setting pages may be accessed without authentication.",
"link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000123.html",
"sec:cpe": [
{
"#text": "cpe:/o:kddi:arrows",
"@product": "arrows",
"@vendor": "KDDI",
"@version": "2.2"
},
{
"#text": "cpe:/o:nttdocomo:arrows",
"@product": "arrows",
"@vendor": "NTT DOCOMO, INC.",
"@version": "2.2"
},
{
"#text": "cpe:/o:nttdocomo:arrows",
"@product": "arrows",
"@vendor": "NTT DOCOMO, INC.",
"@version": "2.2"
},
{
"#text": "cpe:/o:softbank:arrows",
"@product": "arrows",
"@vendor": "SoftBank",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "3.1",
"@severity": "Low",
"@type": "Base",
"@vector": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2024-000123",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN43845108/index.html",
"@id": "JVN#43845108",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-53701",
"@id": "CVE-2024-53701",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Multiple FCNT Android devices vulnerable to authentication bypass"
}
JVNDB-2024-012461
Vulnerability from jvndb - Published: 2024-11-13 05:26 - Updated:2024-11-26 07:11
Severity
Summary
Multiple vulnerabilities in SoftBank Mesh Wi-Fi router RP562B
Details
Mesh Wi-Fi router RP562B provided by SoftBank Corp. contains multiple vulnerabilities listed below.
* Active debug code (CWE-489) - CVE-2024-29075
* OS command injection (CWE-78) - CVE-2024-45827
* Exposure of sensitive system information to an unauthorized control sphere (CWE-497) - CVE-2024-47799
Samy Younsi of NeroTeam Security Labs reported these vulnerabilities to JPCERT/CC.
JPCERT/CC coordinated with the developer.
References
| Type | URL | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-012461.html",
"dc:date": "2024-11-26T16:11+09:00",
"dcterms:issued": "2024-11-13T14:26+09:00",
"dcterms:modified": "2024-11-26T16:11+09:00",
"description": "Mesh Wi-Fi router RP562B provided by SoftBank Corp. contains multiple vulnerabilities listed below.\r\n\r\n * Active debug code (CWE-489) - CVE-2024-29075\r\n * OS command injection (CWE-78) - CVE-2024-45827\r\n * Exposure of sensitive system information to an unauthorized control sphere (CWE-497) - CVE-2024-47799\r\n\r\nSamy Younsi of NeroTeam Security Labs reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.",
"link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-012461.html",
"sec:cpe": {
"#text": "cpe:/o:softbank:mesh_wi-fi_router",
"@product": "Mesh Wi-Fi router RP562B firmware",
"@vendor": "SoftBank",
"@version": "2.2"
},
"sec:cvss": {
"@score": "8.0",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2024-012461",
"sec:references": [
{
"#text": "https://jvn.jp/en/vu/JVNVU90676195/",
"@id": "JVNVU#90676195",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-29075",
"@id": "CVE-2024-29075",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-45827",
"@id": "CVE-2024-45827",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-47799",
"@id": "CVE-2024-47799",
"@source": "CVE"
},
{
"#text": "https://cwe.mitre.org/data/definitions/489.html",
"@id": "CWE-489",
"@title": "Active Debug Code(CWE-489)"
},
{
"#text": "https://cwe.mitre.org/data/definitions/497.html",
"@id": "CWE-497",
"@title": "Exposure of Sensitive System Information to an Unauthorized Control Sphere(CWE-497)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
}
],
"title": "Multiple vulnerabilities in SoftBank Mesh Wi-Fi router RP562B"
}
JVNDB-2022-000101
Vulnerability from jvndb - Published: 2022-12-21 05:13 - Updated:2022-12-21 05:13
Severity
Summary
+Message App improper handling of Unicode control characters
Details
+Message App displays text unprocessed, even when control characters are contained, and the text is shown based on Unicode control character's specifications.
Therefore, a crafted text may display misleading web links (CWE-451).
Akaki Tsunoda reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| Type | URL | |
|---|---|---|
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000101.html",
"dc:date": "2022-12-21T14:13+09:00",
"dcterms:issued": "2022-12-21T14:13+09:00",
"dcterms:modified": "2022-12-21T14:13+09:00",
"description": "+Message App displays text unprocessed, even when control characters are contained, and the text is shown based on Unicode control character\u0027s specifications.\r\nTherefore, a crafted text may display misleading web links (CWE-451).\r\n\r\nAkaki Tsunoda reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000101.html",
"sec:cpe": [
{
"#text": "cpe:/a:kddi:%2b_message",
"@product": "+Message (PlusMessage)",
"@vendor": "KDDI",
"@version": "2.2"
},
{
"#text": "cpe:/a:nttdocomo:%2b_message",
"@product": "+Message (PlusMessage)",
"@vendor": "NTT DOCOMO, INC.",
"@version": "2.2"
},
{
"#text": "cpe:/a:softbank:%2b_message",
"@product": "+Message (PlusMessage)",
"@vendor": "SoftBank",
"@version": "2.2"
}
],
"sec:cvss": [
{
"@score": "4.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"@version": "2.0"
},
{
"@score": "4.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2022-000101",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN43561812/index.html",
"@id": "JVN#43561812",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2022-43543",
"@id": "CVE-2022-43543",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-43543",
"@id": "CVE-2022-43543",
"@source": "NVD"
},
{
"#text": "https://unicode.org/reports/tr36/",
"@id": "Unicode Technical Report #36",
"@source": "Related document"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "+Message App improper handling of Unicode control characters"
}
JVNDB-2021-000069
Vulnerability from jvndb - Published: 2021-07-14 08:13 - Updated:2021-07-14 08:13
Severity
Summary
Optical BB unit E-WMTA2.3 vulnerable to cross-site request forgery
Details
Optical BB unit E-WMTA2.3 provided by SoftBank contains a cross-site request forgery vulnerability (CWE-352).
Hiroki Nishino reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| Type | URL | |
|---|---|---|
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000069.html",
"dc:date": "2021-07-14T17:13+09:00",
"dcterms:issued": "2021-07-14T17:13+09:00",
"dcterms:modified": "2021-07-14T17:13+09:00",
"description": "Optical BB unit E-WMTA2.3 provided by SoftBank contains a cross-site request forgery vulnerability (CWE-352).\r\n\r\nHiroki Nishino reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000069.html",
"sec:cpe": {
"#text": "cpe:/o:softbank:optical_bb_unit_e-wmta_firmware",
"@product": "Optical BB unit E-WMTA",
"@vendor": "SoftBank",
"@version": "2.2"
},
"sec:cvss": [
{
"@score": "4.0",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
"@version": "2.0"
},
{
"@score": "5.4",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2021-000069",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN34364599/index.html",
"@id": "JVN#34364599",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20783",
"@id": "CVE-2021-20783",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20783",
"@id": "CVE-2021-20783",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-352",
"@title": "Cross-Site Request Forgery(CWE-352)"
}
],
"title": "Optical BB unit E-WMTA2.3 vulnerable to cross-site request forgery"
}
JVNDB-2018-000100
Vulnerability from jvndb - Published: 2018-09-27 07:52 - Updated:2019-08-27 08:22
Severity
Summary
+Message App fails to verify SSL server certificates
Details
+Message App fails to verify SSL server certificates.
ma.la of LINE Corporation reported this vulnerability to the developer, and also to IPA in order to notify users of its solution through JVN.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000100.html",
"dc:date": "2019-08-27T17:22+09:00",
"dcterms:issued": "2018-09-27T16:52+09:00",
"dcterms:modified": "2019-08-27T17:22+09:00",
"description": "+Message App fails to verify SSL server certificates.\r\n\r\nma.la of LINE Corporation reported this vulnerability to the developer, and also to IPA in order to notify users of its solution through JVN.\r\n JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000100.html",
"sec:cpe": [
{
"#text": "cpe:/a:kddi:%2b_message",
"@product": "+Message (PlusMessage)",
"@vendor": "KDDI",
"@version": "2.2"
},
{
"#text": "cpe:/a:nttdocomo:%2b_message",
"@product": "+Message (PlusMessage)",
"@vendor": "NTT DOCOMO, INC.",
"@version": "2.2"
},
{
"#text": "cpe:/a:softbank:%2b_message",
"@product": "+Message (PlusMessage)",
"@vendor": "SoftBank",
"@version": "2.2"
}
],
"sec:cvss": [
{
"@score": "4.0",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"@version": "2.0"
},
{
"@score": "4.8",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2018-000100",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN37288228/",
"@id": "JVN#37288228",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0691",
"@id": "CVE-2018-0691",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-0691",
"@id": "CVE-2018-0691",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "+Message App fails to verify SSL server certificates"
}
JVNDB-2017-000080
Vulnerability from jvndb - Published: 2017-05-12 04:36 - Updated:2017-11-27 07:55
Severity
Summary
PrimeDrive Desktop Application Installer may insecurely load executable files
Details
PrimeDrive Desktop Application is the client application for PrimeDrive online storage service provided by SoftBank Corp. The installer of PrimeDrive Desktop Application contains an issue with the file search path, which may insecurely load executable files (CWE-427).
Eili Masami of Tachibana Lab. and Eiji James Yoshida of Security Professionals Network Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000080.html",
"dc:date": "2017-11-27T16:55+09:00",
"dcterms:issued": "2017-05-12T13:36+09:00",
"dcterms:modified": "2017-11-27T16:55+09:00",
"description": "PrimeDrive Desktop Application is the client application for PrimeDrive online storage service provided by SoftBank Corp. The installer of PrimeDrive Desktop Application contains an issue with the file search path, which may insecurely load executable files (CWE-427).\r\n\r\nEili Masami of Tachibana Lab. and Eiji James Yoshida of Security Professionals Network Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000080.html",
"sec:cpe": {
"#text": "cpe:/a:softbank:primedrive_desktop_application",
"@product": "PrimeDrive Desktop Application",
"@vendor": "SoftBank",
"@version": "2.2"
},
"sec:cvss": [
{
"@score": "6.8",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"@version": "2.0"
},
{
"@score": "7.8",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2017-000080",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN16248227/index.html",
"@id": "JVN#16248227",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2167",
"@id": "CVE-2017-2167",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2167",
"@id": "CVE-2017-2167",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "PrimeDrive Desktop Application Installer may insecurely load executable files"
}
JVNDB-2017-000033
Vulnerability from jvndb - Published: 2017-03-01 06:53 - Updated:2017-05-15 02:27
Severity
Summary
PrimeDrive Desktop Application Installer may insecurely load Dynamic Link Libraries
Details
PrimeDrive Desktop Application is the client application for PrimeDrive online storage service provided by SoftBank Corp. The installer of PrimeDrive Desktop Application is vulnerable to load specific Dynamic Link Libraries in the same directory (CWE-427) .
Eiji James Yoshida of Security Professionals Network Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000033.html",
"dc:date": "2017-05-15T11:27+09:00",
"dcterms:issued": "2017-03-01T15:53+09:00",
"dcterms:modified": "2017-05-15T11:27+09:00",
"description": "PrimeDrive Desktop Application is the client application for PrimeDrive online storage service provided by SoftBank Corp. The installer of PrimeDrive Desktop Application is vulnerable to load specific Dynamic Link Libraries in the same directory (CWE-427) .\r\n\r\nEiji James Yoshida of Security Professionals Network Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000033.html",
"sec:cpe": {
"#text": "cpe:/a:softbank:primedrive_desktop_application",
"@product": "PrimeDrive Desktop Application",
"@vendor": "SoftBank",
"@version": "2.2"
},
"sec:cvss": [
{
"@score": "6.8",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"@version": "2.0"
},
{
"@score": "7.8",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2017-000033",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN88713190/index.html",
"@id": "JVN#88713190",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2108",
"@id": "CVE-2017-2108",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-2108",
"@id": "CVE-2017-2108",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "PrimeDrive Desktop Application Installer may insecurely load Dynamic Link Libraries"
}
CVE-2021-20783 (GCVE-0-2021-20783)
Vulnerability from cvelistv5 – Published: 2021-07-28 00:45 – Updated: 2024-08-03 17:53
VLAI
EPSS
VEX
Summary
Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of administrators via a specially crafted page.
Severity
No CVSS data available.
CWE
- Cross-site request forgery
Assigner
jpcert
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://jvn.jp/en/jp/JVN34364599/index.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SoftBank | Optical BB unit E-WMTA2.3 |
Affected:
all versions
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:53:22.630Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN34364599/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Optical BB unit E-WMTA2.3",
"vendor": "SoftBank",
"versions": [
{
"status": "affected",
"version": "all versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of administrators via a specially crafted page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site request forgery",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-28T00:45:24.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jvn.jp/en/jp/JVN34364599/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2021-20783",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Optical BB unit E-WMTA2.3",
"version": {
"version_data": [
{
"version_value": "all versions"
}
]
}
}
]
},
"vendor_name": "SoftBank"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of administrators via a specially crafted page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-site request forgery"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jvn.jp/en/jp/JVN34364599/index.html",
"refsource": "MISC",
"url": "https://jvn.jp/en/jp/JVN34364599/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2021-20783",
"datePublished": "2021-07-28T00:45:24.000Z",
"dateReserved": "2020-12-17T00:00:00.000Z",
"dateUpdated": "2024-08-03T17:53:22.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}