Multiple vulnerabilities in Rakuten Casa



Published: 2022-05-19
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2022-29525
CVE-2022-28704
CVE-2022-26834
CWE-ID CWE-798
CWE-284
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Rakuten Casa
Mobile applications / Apps for mobile phones

Vendor Rakuten Mobile

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Use of hard-coded credentials

EUVDB-ID: #VU63455

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29525

CWE-ID: CWE-798 - Use of Hard-coded Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Rakuten Casa: AP_F_V1_4_1 - AP_F_V2_0_0


CPE2.3 External links

http://jvn.jp/en/jp/JVN46892984/index.html
http://network.mobile.rakuten.co.jp/information/news/product/1033/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU63456

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-28704

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Rakuten Casa: AP_F_V1_4_1 - AP_F_V2_0_0


CPE2.3 External links

http://jvn.jp/en/jp/JVN46892984/index.html
http://network.mobile.rakuten.co.jp/information/news/product/1033/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper access control

EUVDB-ID: #VU63457

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26834

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Rakuten Casa: AP_F_V1_4_1 - AP_F_V2_0_0


CPE2.3 External links

http://jvn.jp/en/jp/JVN46892984/index.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###