KDDI HGW-BL1500HM Path Traversal Vulnerability in USB Storage File Sharing
Vulnerability
A path traversal vulnerability has been identified in the USB storage file-sharing function of the KDDI HGW-BL1500HM home gateway, specifically in versions through 002.002.003. This vulnerability arises from improper limitations on pathnames, allowing files to be accessed or modified by sending a crafted HTTP request to certain functions of the product from a device connected to the LAN.
Impact
Exploitation of this vulnerability could lead to unauthorized access to, or modification of, the product's files. Additionally, according to JPCERT, arbitrary code could be executed on the web browser of a user interacting with the device's configuration page or LAN-accessible functions.
Remediation
Users are advised to update the firmware to the latest version. The device automatically communicates with KDDI's central system to download and install new firmware, maintaining an optimal state. No user action is required, but the device should be connected to the internet and powered on.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.