CVE-2022-26834

Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to obtain the information stored in the product because the product is set to accept HTTP connections from the WAN side by default.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://jvn.jp/en/jp/JVN46892984/index.html	Third Party Advisory VDB Entry
https://network.mobile.rakuten.co.jp/information/news/product/1033/	Vendor Advisory
https://jvn.jp/en/jp/JVN46892984/index.html	Third Party Advisory VDB Entry
https://network.mobile.rakuten.co.jp/information/news/product/1033/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rakuten:casa:ap_f_v1_4_1:::::::*
	cpe:2.3:a:rakuten:casa:ap_f_v2_0_0:::::::*

History

No history.

Information

Published : 2022-06-13 05:15

Updated : 2024-11-21 06:54

NVD link : CVE-2022-26834

Mitre link : CVE-2022-26834

CVE.ORG link : CVE-2022-26834

JSON object : View

Products Affected

rakuten

casa

CWE

NVD-CWE-Other

{"id": "CVE-2022-26834", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-06-13T05:15:11.143", "references": [{"url": "https://jvn.jp/en/jp/JVN46892984/index.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}, {"url": "https://network.mobile.rakuten.co.jp/information/news/product/1033/", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN46892984/index.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://network.mobile.rakuten.co.jp/information/news/product/1033/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to obtain the information stored in the product because the product is set to accept HTTP connections from the WAN side by default."}, {"lang": "es", "value": "Una vulnerabilidad de control de acceso inapropiado en Rakuten Casa versiones AP_F_V1_4_1 o AP_F_V2_0_0, permite a un atacante remoto obtener la informaci\u00f3n almacenada en el producto porque \u00e9ste est\u00e1 configurado para aceptar conexiones HTTP desde el lado WAN por defecto"}], "lastModified": "2024-11-21T06:54:36.587", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rakuten:casa:ap_f_v1_4_1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1FD3B2B-54E6-4B63-982C-D993BF58885A"}, {"criteria": "cpe:2.3:a:rakuten:casa:ap_f_v2_0_0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "954CEA14-FC4C-438C-B71B-8516C47D71DD"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}