NVD Vulnerability Detail

CVE-2015-6023

Summary	ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypass intended access restrictions via a direct request. NOTE: this issue can be combined with CVE-2015-6024 to execute arbitrary commands.
Publication Date	Feb. 10, 2017, 12:59 a.m.
Registration Date	Jan. 26, 2021, 2:53 p.m.
Last Update	Nov. 21, 2024, 11:34 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:netcommwireless:hspa_3g10wve_firmware:3g10wve-l101-s306ets-c01_r03:::::::*
execution environment
1	cpe:2.3:h:netcommwireless:hspa_3g10wve:-:::::::*

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/136901/NetCommWireless-HSPA-3G10WVE-Authentication-Bypass-Code-Execution.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/136901/NetCommWireless-HSPA-3G10WVE-Authentication-Bypass-Code-Execution.html	Exploit Third Party Advisory VDB Entry
3	http://seclists.org/fulldisclosure/2016/May/13	Exploit Mailing List Third Party Advisory
4	http://seclists.org/fulldisclosure/2016/May/13	Exploit Mailing List Third Party Advisory
5	http://seclists.org/fulldisclosure/2016/May/18	Mailing List Third Party Advisory
6	http://seclists.org/fulldisclosure/2016/May/18	Mailing List Third Party Advisory
7	http://www.securityfocus.com/archive/1/538263/100/0/threaded
8	http://www.securityfocus.com/archive/1/538263/100/0/threaded
9	http://www.securityfocus.com/archive/1/538297/100/0/threaded
10	http://www.securityfocus.com/archive/1/538297/100/0/threaded
11	http://www.securityfocus.com/bid/96383	Third Party Advisory VDB Entry
12	http://www.securityfocus.com/bid/96383	Third Party Advisory VDB Entry
13	https://www.exploit-db.com/exploits/39762/	Exploit Third Party Advisory VDB Entry
14	https://www.exploit-db.com/exploits/39762/	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-284	不適切なアクセス制御	https://cwe.mitre.org/data/definitions/284.html

JVN Vulnerability Information

NetCommWireless HSPA 3G10WVE Wireless Router のファームウェアの ping.cgi におけるアクセス制限を回避される脆弱性

Title	NetCommWireless HSPA 3G10WVE Wireless Router のファームウェアの ping.cgi におけるアクセス制限を回避される脆弱性
Summary	NetCommWireless HSPA 3G10WVE Wireless Router のファームウェアの ping.cgi には、アクセス制限を回避される脆弱性が存在します。本脆弱性は、CVE-2015-6024 と併用され、任意のコードを実行される可能性があります。
Possible impacts	リモートの攻撃者により、直接のリクエストを介して、アクセス制限を回避される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Sept. 3, 2015, midnight
Registration Date	March 30, 2017, 3:31 p.m.
Last Update	March 30, 2017, 3:31 p.m.

Affected System

NetComm Wireless Limited.

NetCommWireless HSPA 3G10WVE

NetCommWireless HSPA 3G10WVE ファームウェア 3G10WVE-L101-S306ETS-C01_R05 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-6023	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6023
National Vulnerability Database (NVD)
2	CVE-2015-6023	https://nvd.nist.gov/vuln/detail/CVE-2015-6023

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-284	https://cwe.mitre.org/data/definitions/284.html

ベンダー情報

No	Name	URL
NetComm Wireless Limited.
1	Top Page	http://www.netcommwireless.com/

その他

No	Name	URL
関連文書
1	NetCommWireless HSPA 3G10WVE Authentication Bypass / Code Execution	https://packetstormsecurity.com/files/136901/NetCommWireless-HSPA-3G10WVE-Authentication-Bypass-Code-Execution.html

Change Log

No	Changed Details	Date of change
0	[2017年03月30日] 掲載	Feb. 17, 2018, 10:37 a.m.