Search criteria

3 vulnerabilities found for pwr-q200_firmware by ntt-east

FKIE_CVE-2017-10874

Vulnerability from fkie_nvd - Published: 2017-12-01 14:29 - Updated: 2025-04-20 01:37
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning attacks.
References
vultures@jpcert.or.jphttp://web116.jp/shop/hikari_p/q200/q200_00.htmlIssue Tracking, Third Party Advisory
vultures@jpcert.or.jphttps://jvn.jp/en/jp/JVN73141967/index.htmlThird Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://web116.jp/shop/hikari_p/q200/q200_00.htmlIssue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://jvn.jp/en/jp/JVN73141967/index.htmlThird Party Advisory, VDB Entry
Impacted products
Vendor Product Version
ntt-east pwr-q200_firmware -
ntt-east pwr-q200 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ntt-east:pwr-q200_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B28C389-C239-4F37-B8CA-8525FEC38799",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ntt-east:pwr-q200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DE0BFD2-7A8F-4270-AAB3-DA5AB9C83655",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning attacks."
    },
    {
      "lang": "es",
      "value": "PWR-Q200 no utiliza valores aleatorios para los puertos de origen de los paquetes de consultas DNS, lo que permite que los atacantes remotos realicen ataques de envenenamiento de la memoria cach\u00e9 DNS."
    }
  ],
  "id": "CVE-2017-10874",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-12-01T14:29:00.240",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "http://web116.jp/shop/hikari_p/q200/q200_00.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://jvn.jp/en/jp/JVN73141967/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "http://web116.jp/shop/hikari_p/q200/q200_00.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://jvn.jp/en/jp/JVN73141967/index.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-330"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2017-10874 (GCVE-0-2017-10874)

Vulnerability from cvelistv5 – Published: 2017-12-01 14:00 – Updated: 2024-08-05 17:50
VLAI?
Summary
PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning attacks.
Severity ?
No CVSS data available.
CWE
  • Use of Insufficiently Random Values
Assigner
References
Impacted products
Vendor Product Version
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PWR-Q200 Affected: all firmware versions
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:50:12.521Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web116.jp/shop/hikari_p/q200/q200_00.html"
          },
          {
            "name": "JVN#73141967",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN73141967/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PWR-Q200",
          "vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "all firmware versions"
            }
          ]
        }
      ],
      "datePublic": "2017-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use of Insufficiently Random Values",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-01T13:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web116.jp/shop/hikari_p/q200/q200_00.html"
        },
        {
          "name": "JVN#73141967",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN73141967/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-10874",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PWR-Q200",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "all firmware versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Use of Insufficiently Random Values"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://web116.jp/shop/hikari_p/q200/q200_00.html",
              "refsource": "CONFIRM",
              "url": "http://web116.jp/shop/hikari_p/q200/q200_00.html"
            },
            {
              "name": "JVN#73141967",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN73141967/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-10874",
    "datePublished": "2017-12-01T14:00:00",
    "dateReserved": "2017-07-04T00:00:00",
    "dateUpdated": "2024-08-05T17:50:12.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-10874 (GCVE-0-2017-10874)

Vulnerability from nvd – Published: 2017-12-01 14:00 – Updated: 2024-08-05 17:50
VLAI?
Summary
PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning attacks.
Severity ?
No CVSS data available.
CWE
  • Use of Insufficiently Random Values
Assigner
References
Impacted products
Vendor Product Version
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION PWR-Q200 Affected: all firmware versions
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:50:12.521Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web116.jp/shop/hikari_p/q200/q200_00.html"
          },
          {
            "name": "JVN#73141967",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN73141967/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PWR-Q200",
          "vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION",
          "versions": [
            {
              "status": "affected",
              "version": "all firmware versions"
            }
          ]
        }
      ],
      "datePublic": "2017-11-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use of Insufficiently Random Values",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-01T13:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web116.jp/shop/hikari_p/q200/q200_00.html"
        },
        {
          "name": "JVN#73141967",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN73141967/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2017-10874",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PWR-Q200",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "all firmware versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Use of Insufficiently Random Values"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://web116.jp/shop/hikari_p/q200/q200_00.html",
              "refsource": "CONFIRM",
              "url": "http://web116.jp/shop/hikari_p/q200/q200_00.html"
            },
            {
              "name": "JVN#73141967",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN73141967/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2017-10874",
    "datePublished": "2017-12-01T14:00:00",
    "dateReserved": "2017-07-04T00:00:00",
    "dateUpdated": "2024-08-05T17:50:12.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}