CVE-2017-2235
CriticalSummary
Toshiba Home gateway HEM-GW16A and HEM-GW26A firmware versions V1.2.0 and earlier allow an attacker to bypass access restrictions to change the administrator account password.
Risk Assessment
The ability to change the administrator account password poses a serious risk of device takeover, potentially leading to further attacks on the local network.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability and implement additional security measures.
Other vulnerabilities in Toshiba Home gateway HEM-GW16A, HEM-GW26A
See all- CVE-2017-2237Critical
Toshiba Home gateway HEM-GW16A and HEM-GW26A firmware versions HEM-GW16A-FW-V1.2.0 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors.
- CVE-2017-2236Critical
The Toshiba Home gateway HEM-GW16A and HEM-GW26A firmware contains hard-coded credentials, which may allow attackers to perform operations on the device with administrative privileges.
- CVE-2017-2234Critical
The firmware of Toshiba Home gateway HEM-GW16A and HEM-GW26A in versions V1.2.0 and earlier may allow remote attackers to access a non-documented developer screen, enabling operations with administrative privileges.
Original NVD description (English source)
Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier. Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earlier allows an attacker to bypass access restriction to change the administrator account password via unspecified vectors.