CVE编号
CVE-2019-5986利用情况
暂无补丁情况
N/A披露时间
2019-09-13漏洞描述
Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway是日报电信电话（Nippon Telegraph and Telephone）公司的一款为其光纤服务用户提供的IP电话服务。 Nippon Telegraph and Telephone Hikari Denwa Phone Home Gateway中存在跨站请求伪造漏洞。该漏洞源于WEB应用未充分验证请求是否来自可信用户。攻击者可利用该漏洞通过受影响客户端向服务器发送非预期的请求。以下产品及版本受到影响：使用19.41及之前版本固件的PR-S300NE/RT-S300NE/RV-S340NE；使用19.01.0005及之前版本固件的PR-S300HI/RT-S300HI/RV-S340HI；使用19.40及之前版本固件的PR-S300SE/RT-S300SE/RV-S340SE；使用7.42及之前版本固件的PR-400NE/RT-400NE/RV-440NE；使用07.00.1010及之前版本固件的PR-400KI/RT-400KI/RV-440KI；使用07.00.1012及之前版本固件的PR-400MI/RT-400MI/RV-440MI；使用01.00.0090及之前版本固件的PR-500KI/RT-500KI；使用01.00.0070及之前版本固件的RS-500KI；使用01.01.0014及之前版本固件的PR-500MI/RT-500MI；使用03.01.0019及之前版本固件的RS-500MI。解决建议
目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接：https://www.ntt-west.co.jp/kiki/support/flets/hgw/190626.html
参考链接 |
|
|---|---|
| http://jvn.jp/en/jp/JVN43172719/index.html | |
| https://www.ntt-west.co.jp/kiki/support/flets/hgw/190626.html |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | pr-400ki_firmware | * |
Up to (including) 07.00.1010 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | pr-400mi_firmware | * |
Up to (including) 07.00.1012 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | pr-400ne_firmware | * |
Up to (including) 7.42 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | pr-500ki_firmware | * |
Up to (including) 01.00.0090 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | pr-500mi_firmware | * |
Up to (including) 01.01.0014 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | pr-s300hi_firmware | * |
Up to (including) 19.01.0005 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | pr-s300ne_firmware | * |
Up to (including) 19.41 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | pr-s300se_firmware | * |
Up to (including) 19.40 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rs-500ki_firmware | * |
Up to (including) 01.00.0070 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rs-500mi_firmware | * |
Up to (including) 03.01.0019 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rt-400ki_firmware | * |
Up to (including) 07.00.1010 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rt-400mi_firmware | * |
Up to (including) 07.00.1012 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rt-400ne_firmware | * |
Up to (including) 7.42 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rt-500ki_firmware | * |
Up to (including) 01.00.0090 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rt-500mi_firmware | * |
Up to (including) 01.01.0014 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rt-s300hi_firmware | * |
Up to (including) 19.01.0005 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rt-s300ne_firmware | * |
Up to (including) 19.41 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rt-s300se_firmware | * |
Up to (including) 19.40 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rv-440ki_firmware | * |
Up to (including) 07.00.1010 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rv-440mi_firmware | * |
Up to (including) 07.00.1012 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rv-440ne_firmware | * |
Up to (including) 7.42 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rv-s340hi_firmware | * |
Up to (including) 19.01.0005 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rv-s340ne_firmware | * |
Up to (including) 19.41 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-east | rv-s340se_firmware | * |
Up to (including) 19.40 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | pr-400ki_firmware | * |
Up to (including) 07.00.1010 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | pr-400mi_firmware | * |
Up to (including) 07.00.1012 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | pr-400ne_firmware | * |
Up to (including) 7.42 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | pr-500ki_firmware | * |
Up to (including) 01.00.0090 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | pr-500mi_firmware | * |
Up to (including) 01.01.0011 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | pr-s300hi_firmware | * |
Up to (including) 19.01.0005 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | pr-s300ne_firmware | * |
Up to (including) 19.41 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | pr-s300se_firmware | * |
Up to (including) 19.40 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rt-400ki_firmware | * |
Up to (including) 07.00.1010 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rt-400mi_firmware | * |
Up to (including) 07.00.1012 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rt-400ne_firmware | * |
Up to (including) 7.42 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rt-500ki_firmware | * |
Up to (including) 01.00.0090 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rt-500mi_firmware | * |
Up to (including) 01.01.0011 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rt-s300hi_firmware | * |
Up to (including) 19.01.0005 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rt-s300ne_firmware | * |
Up to (including) 19.41 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rt-s300se_firmware | * |
Up to (including) 19.40 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rv-440ki_firmware | * |
Up to (including) 07.00.1010 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rv-440mi_firmware | * |
Up to (including) 07.00.1012 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rv-440ne_firmware | * |
Up to (including) 7.42 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rv-s340hi_firmware | * |
Up to (including) 19.01.0005 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rv-s340ne_firmware | * |
Up to (including) 19.41 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ntt-west | rv-s340se_firmware | * |
Up to (including) 19.40 |
|||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | pr-400ki | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | pr-400mi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | pr-400ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | pr-500ki | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | pr-500mi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | pr-s300hi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | pr-s300ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | pr-s300se | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rs-500ki | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rs-500mi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rt-400ki | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rt-400mi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rt-400ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rt-500ki | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rt-500mi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rt-s300hi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rt-s300ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rt-s300se | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rv-440ki | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rv-440mi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rv-440ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rv-s340hi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rv-s340ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-east | rv-s340se | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | pr-400ki | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | pr-400mi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | pr-400ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | pr-500ki | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | pr-500mi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | pr-s300hi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | pr-s300ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | pr-s300se | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rt-400ki | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rt-400mi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rt-400ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rt-500ki | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rt-500mi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rt-s300hi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rt-s300ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rt-s300se | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rv-440ki | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rv-440mi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rv-440ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rv-s340hi | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rv-s340ne | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | ntt-west | rv-s340se | - | - | |||||
- 攻击路径 网络
- 攻击复杂度 低
- 权限要求 无
- 影响范围 未更改
- 用户交互 需要
- 可用性 高
- 保密性 高
- 完整性 高
还没有评论，来说两句吧...