Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 56 views

    TDSCSA00436 Multiple Vulnerabilities in CANVIO Network Storage Products

    Uploaded by

    Malxir
    1) There are multiple vulnerabilities including remote code execution in Toshiba CANVIO wireless storage and NAS products. 2) Impacted products and firmware versions are listed. Vulnerabilities allow remote attackers to access and modify information or take control of devices. 3) Workarounds are provided to mitigate risks including using firewalls, updating firmware, changing passwords, and disconnecting from mobile networks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    TDSCSA00436 Multiple Vulnerabilities in CANVIO Network Storage Products

    Uploaded by

    Malxir
    56 views3 pages
    1) There are multiple vulnerabilities including remote code execution in Toshiba CANVIO wireless storage and NAS products. 2) Impacted products and firmware versions are listed. Vulnerabilities allow remote attackers to access and modify information or take control of devices. 3) Workarounds are provided to mitigate risks including using firewalls, updating firmware, changing passwords, and disconnecting from mobile networks.

    Original Title

    oss_vulnerability_notice

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    1) There are multiple vulnerabilities including remote code execution in Toshiba CANVIO wireless storage and NAS products. 2) Impacted products and firmware versions are listed. Vulnerabilities allow remote attackers to access and modify information or take control of devices. 3) Workarounds are provided to mitigate risks including using firewalls, updating firmware, changing passwords, and disconnecting from mobile networks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    56 views3 pages

    TDSCSA00436 Multiple Vulnerabilities in CANVIO Network Storage Products

    Uploaded by

    Malxir
    1) There are multiple vulnerabilities including remote code execution in Toshiba CANVIO wireless storage and NAS products. 2) Impacted products and firmware versions are listed. Vulnerabilities allow remote attackers to access and modify information or take control of devices. 3) Workarounds are provided to mitigate risks including using firewalls, updating firmware, changing passwords, and disconnecting from mobile networks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 3

    July 20, 2018

    TDSCSA00436：Multiple Vulnerabilities in CANVIO Network Storage Products

    Toshiba Electronic Devices & Storage Corporation


    ■Overview
    There are multiple vulnerabilities including remote arbitrary code execution in the
    CANVIO (STOR.E) wireless products and NAS products (the “Affected Network Storage
    Product”). Please stop using them or apply the workarounds so that these may mitigate
    the impact of these vulnerabilities.

    ■Affected Network Storage Products


    Product Name
    Product Category Model No. Firmware Version
    (varied by location)

    CANVIO AeroCast /
    HDTU110*KWC1 1.2.8 or earlier
    CANVIO AeroCast wireless HDD

    Wireless products CANVIO Wireless Adapter /


    STOR.E Wireless Adapter / HDWW100*KW*1 2.0.7 or earlier
    CANVIO Cast Wireless Adapter

    CANVIO PERSONAL CLOUD /


    NAS products HDNB1*0*E*1 0011.3050 or earlier
    CANVIO HOME

    Note: An asterisk mark (*) is an alphanumeric character.

    ■Impact
    OSS modules in the Affected Network Storage Products, including samba, have known
    vulnerabilities including CVE-2017-7494. The details are shown in the following
    “Vulnerability Information for each OSS module list ”.
    These vulnerabilities allow remote attackers to cause information leakage / modification,
    and to potentially take control of the Affected Network Storage Products.

    <Vulnerability Information for each OSS module list>


    ■Workarounds
    ・Please understand that the impact may occur if you continue to use the Affected
    Network Storage Products.
    ・The following workarounds may mitigate the impact of these vulnerabilities in the
    Affected Network Storage Products.
    Connection types Method to mitigate the impact of these vulnerabilities

    NAS product Wireless product

    Via home broadband network Filter traffic related to the Set Wireless product up to AP
    vulnerabilities using a firewall mode. *1 *2
    device, such as a broadband router.

    Via wireless LAN Confirm that there are no wireless 1. Update the latest firmware that
    communication devices within your fixed WPA2 vulnerabilities of
    local network. Wireless product.
    2. Change the default password to a
    unique password.

    Via mobile broadband network Disconnect from WWAN *3


    (smart phone, tablet,
    WWAN-equipped PC, etc.) *3

    *1: Please be sure to download the user manual and read it carefully prior to setup.
    *2: Please be sure to update the latest firmware that addressed WPA2 vulnerabilities.
    *3: WWAN means “Wireless Wide Area Network”.
    Note: Toshiba Electronic Devices & Storage Corporation terminates the software update for the Affected Network
    Storage Product.
    Note: Please be sure to apply the appropriate firmware update according to the information provided by the
    manufacturer of any devices that are connected to the Affected Network Storage Product.

    <Attack route>
    <Wireless products>
    Different connection modes
    ・Use the “AP mode” (shown below) to mitigate the impact of these vulnerabilities.
    ・Please be aware that it is possible that in station and bridge mode vulnerabilities can
    occur.

    ※1

    ※1:You cannot use ChromecastTM function after the setup".


    ※ Chromecast is trademark of Google, Inc.
    Product Name Manual

    CANVIO AeroCast /
    > Download
    CANVIO AeroCast wireless HDD

    CANVIO Wireless Adapter /


    STOR.E Wireless Adapter / > Download
    CANVIO Cast Wireless Adapter

    ■ Reference
    ・The latest firmware to address WPA2 vulnerability
    ・ Common Vulnerability Scoring System SIG
    ・”Software Update Termination for CANVIO Network Storage Products”

    ■Contact Information
    https://storage.toshiba.com/consumer-hdd/support/contact

    You might also like