KDDI HGW-BL1500HM Path Traversal Vulnerability in USB File Download Function

A path traversal vulnerability has been identified in the file download process of the USB storage file-sharing function on the KDDI HGW-BL1500HM home gateway, all versions through 002.002.003. This vulnerability allows files on the device to be accessed and potentially modified by sending a crafted HTTP request to specific functions of the product from a device connected to the LAN.

Impact

Exploitation of this vulnerability could lead to unauthorized access to, and modification of, the product's files.

Remediation

Users are advised to update the firmware to the latest version. The device automatically communicates with KDDI's central system to download and install new firmware updates, maintaining optimal performance. No user action is required, but the device should be connected to the internet and powered on.