cnvd-2019-22848
Vulnerability from cnvd
Title
Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway跨站请求伪造漏洞
Description
Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway是日报电信电话（Nippon Telegraph and Telephone）公司的一款为其光纤服务用户提供的IP电话服务。 Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway中存在跨站请求伪造漏洞。该漏洞源于WEB应用未充分验证请求是否来自可信用户。攻击者可利用该漏洞通过受影响客户端向服务器发送非预期的请求。
Severity
低
Patch Name
Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway跨站请求伪造漏洞的补丁
Patch Description
Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway是日报电信电话（Nippon Telegraph and Telephone）公司的一款为其光纤服务用户提供的IP电话服务。 Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway中存在跨站请求伪造漏洞。该漏洞源于WEB应用未充分验证请求是否来自可信用户。攻击者可利用该漏洞通过受影响客户端向服务器发送非预期的请求。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://www.ntt-west.co.jp/kiki/support/flets/hgw/190626.html

Reference
https://jvn.jp/en/jp/JVN43172719/
Impacted products
Name
['NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware <=19.41', 'NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300HI/RT-S300HI/RV-S340HI firmware <=19.01.0005', 'NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300SE/RT-S300SE/RV-S340SE firmware <=19.40', 'NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-400NE/RT-400NE/RV-440NE firmware <=7.42', 'NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-400KI/RT-400KI/RV-440KI firmware <=07.00.1010', 'NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-400MI/RT-400MI/RV-440MI firmware <=07.00.1012', 'NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-500KI/RT-500KI firmware <=01.00.0090', 'NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION RS-500KI firmware <=01.00.0070', 'NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-500MI/RT-500MI firmware <=01.01.0014', 'NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION RS-500MI firmware <=03.01.0019', 'NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware <=19.41', 'NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300HI/RT-S300HI/RV-S340HI firmware <=19.01.0005', 'NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300SE/RT-S300SE/RV-S340SE firmware <=19.40', 'NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-400NE/RT-400NE/RV-440NE firmware <=7.42', 'NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-400KI/RT-400KI/RV-440KI firmware <=07.00.1010', 'NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-400MI/RT-400MI/RV-440MI firmware <=07.00.1012', 'NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-500KI/RT-500KI firmware <=01.00.0090', 'NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-500MI/RT-500MI firmware <=01.01.0011']
Show details on source website

To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-5986"
    }
  },
  "description": "Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway\u662f\u65e5\u62a5\u7535\u4fe1\u7535\u8bdd\uff08Nippon Telegraph and Telephone\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u4e3a\u5176\u5149\u7ea4\u670d\u52a1\u7528\u6237\u63d0\u4f9b\u7684IP\u7535\u8bdd\u670d\u52a1\u3002\n\nNippon Telegraph and Telephone Hikari Denwa Phone Home Gateway\u4e2d\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8eWEB\u5e94\u7528\u672a\u5145\u5206\u9a8c\u8bc1\u8bf7\u6c42\u662f\u5426\u6765\u81ea\u53ef\u4fe1\u7528\u6237\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d7\u5f71\u54cd\u5ba2\u6237\u7aef\u5411\u670d\u52a1\u5668\u53d1\u9001\u975e\u9884\u671f\u7684\u8bf7\u6c42\u3002",
  "discovererName": "Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc.",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.ntt-west.co.jp/kiki/support/flets/hgw/190626.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-22848",
  "openTime": "2019-07-17",
  "patchDescription": "Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway\u662f\u65e5\u62a5\u7535\u4fe1\u7535\u8bdd\uff08Nippon Telegraph and Telephone\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u4e3a\u5176\u5149\u7ea4\u670d\u52a1\u7528\u6237\u63d0\u4f9b\u7684IP\u7535\u8bdd\u670d\u52a1\u3002\r\n\r\nNippon Telegraph and Telephone Hikari Denwa Phone Home Gateway\u4e2d\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8eWEB\u5e94\u7528\u672a\u5145\u5206\u9a8c\u8bc1\u8bf7\u6c42\u662f\u5426\u6765\u81ea\u53ef\u4fe1\u7528\u6237\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d7\u5f71\u54cd\u5ba2\u6237\u7aef\u5411\u670d\u52a1\u5668\u53d1\u9001\u975e\u9884\u671f\u7684\u8bf7\u6c42\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware \u003c=19.41",
      "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300HI/RT-S300HI/RV-S340HI firmware \u003c=19.01.0005",
      "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-S300SE/RT-S300SE/RV-S340SE firmware \u003c=19.40",
      "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-400NE/RT-400NE/RV-440NE firmware \u003c=7.42",
      "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-400KI/RT-400KI/RV-440KI firmware \u003c=07.00.1010",
      "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-400MI/RT-400MI/RV-440MI firmware \u003c=07.00.1012",
      "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-500KI/RT-500KI firmware \u003c=01.00.0090",
      "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION RS-500KI firmware \u003c=01.00.0070",
      "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PR-500MI/RT-500MI firmware \u003c=01.01.0014",
      "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION RS-500MI firmware \u003c=03.01.0019",
      "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300NE/RT-S300NE/RV-S340NE firmware \u003c=19.41",
      "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300HI/RT-S300HI/RV-S340HI firmware \u003c=19.01.0005",
      "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-S300SE/RT-S300SE/RV-S340SE firmware \u003c=19.40",
      "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-400NE/RT-400NE/RV-440NE firmware \u003c=7.42",
      "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-400KI/RT-400KI/RV-440KI firmware \u003c=07.00.1010",
      "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-400MI/RT-400MI/RV-440MI firmware \u003c=07.00.1012",
      "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-500KI/RT-500KI firmware \u003c=01.00.0090",
      "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION PR-500MI/RT-500MI firmware \u003c=01.01.0011"
    ]
  },
  "referenceLink": "https://jvn.jp/en/jp/JVN43172719/",
  "serverity": "\u4f4e",
  "submitTime": "2019-06-28",
  "title": "Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.