Vulnerability Report

CVE-2017-2149

Title: Toshiba Flashair Auth Bypass

Auth Bypass

Proof Of Concept

No public PoC currently indexed for CVE-2017-2149.

CWE Category CWE-426

Published Date Apr 28, 2017

Modified Date May 13, 2026

Exploit Status Not Found

Score 8.8 CVSS v3.0

Exploit Probability (EPSS)

7.54%

Vulnerability Summary

CVE-2017-2149: Untrusted search path vulnerability in installers of the software for SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool V1.00.03 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Configuration Software V3.0.2 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WE series<W-03>) V3.00.01, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WD/WC series<W-02>) V2.00.03 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WB/WL series) V1.00.04 and earlier, SDHC Memory Card with embedded TransferJet functionality Configuration Software V1.02 and earlier, SDHC Memory Card with embedded TransferJet functionality Software Update tool V1.00.06 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

Impacted Vendors

toshiba 1

Reference Links

http://jvn.jp/en/jp/JVN05340816/index.html http://www.securityfocus.com/bid/97697 http://www.toshiba-personalstorage.net/news/20170414.htm http://jvn.jp/en/jp/JVN05340816/index.html http://www.securityfocus.com/bid/97697 http://www.toshiba-personalstorage.net/news/20170414.htm

CVSS v3.0

Source Entity [email protected]

Severity HIGH

8.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity HIGH

9.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns