Vulnerability Report

CVE-2016-4863

Title: Toshiba Flashair Auth Bypass

Auth Bypass

Proof Of Concept

No public PoC currently indexed for CVE-2016-4863.

CWE Category CWE-287

Published Date May 22, 2017

Modified Date May 13, 2026

Exploit Status Not Found

Score 4.3 CVSS v3.0

Exploit Probability (EPSS)

0.12%

Vulnerability Summary

CVE-2016-4863: The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later, FlashAir III Class 10 model W-03 series, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later, FlashAir W-03 series Class 10 model does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled, which allows attackers with access to STA side LAN can obtain files or data.

Impacted Vendors

toshiba 1

Reference Links

http://jvndb.jvn.jp/jvndb/JVNDB-2016-000168 http://www.securityfocus.com/bid/93479 https://jvn.jp/en/jp/JVN39619137/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2016-000168 http://www.securityfocus.com/bid/93479 https://jvn.jp/en/jp/JVN39619137/index.html

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

4.3

Attack Vector

ADJACENT_NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0

Source Entity [email protected]

Severity LOW

3.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:A/AC:L/Au:N/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns