Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for Wi-Fi STATION SH-52A by NTT DOCOMO, INC.

    JVNDB-2026-000043

    Vulnerability from jvndb - Published: 2026-03-25 18:41 - Updated:2026-03-25 18:41
    Severity
    5.7 (Medium) - cvssV3_0 - CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    Summary
    SHARP routers missing authentication for some web APIs
    Details
    SHARP routers do not perform authentication for some web APIs. Those web APIs provide device information, and the initial administrative password is based on a part of the device information.
    • Missing authentication for critical function (CWE-306) - CVE-2026-32326
    Shota Zaizen reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
    References
    Impacted products
    Show details on JVN DB website
    To clipboard 

    {
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000043.html",
  "dc:date": "2026-03-25T18:41+09:00",
  "dcterms:issued": "2026-03-25T18:41+09:00",
  "dcterms:modified": "2026-03-25T18:41+09:00",
  "description": "SHARP routers do not perform authentication for some web APIs.\r\nThose web APIs provide device information, and the initial administrative password is based on a part of the device information.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/306.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eMissing authentication for critical function (CWE-306) - CVE-2026-32326\u003c/li\u003e\u003c/ul\u003eShota Zaizen reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000043.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:kddi:speed_wi-fi_5g_x01",
      "@product": "Speed Wi-Fi 5G X01",
      "@vendor": "KDDI",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:home_5g_hr01",
      "@product": "home 5G HR01",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:home_5g_hr02",
      "@product": "home 5G HR02",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:wi-fi_station_sh-52a_firmware",
      "@product": "Wi-Fi STATION SH-52A",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:wi-fi_station_sh-52b_firmware",
      "@product": "Wi-Fi STATION SH-52B",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nttdocomo:wi-fi_station_sh-54c_firmware",
      "@product": "Wi-Fi STATION SH-54C",
      "@vendor": "NTT DOCOMO, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:softbank:5gmobile_wi-fi_router_sh-u01",
      "@product": "5G Mobile Router SH-U01",
      "@vendor": "SoftBank",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:softbank:pocket_wifi_5g_a503sh",
      "@product": "Pocket WiFi 5G A503SH versions",
      "@vendor": "SoftBank",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "5.7",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000043",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN49524110/index.html",
      "@id": "JVN#49524110",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-32326",
      "@id": "CVE-2026-32326",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "SHARP routers missing authentication for some web APIs"
}

    JVNDB-2021-000107

    Vulnerability from jvndb - Published: 2021-11-30 14:49 - Updated:2021-11-30 14:49
    Severity
    2.9 (Low) - cvssV3_0 - CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
    Summary
    Wi-Fi STATION SH-52A vulnerable to cross-site scripting
    Details
    Wi-Fi STATION SH-52A provided by NTT DOCOMO, INC. contains a cross-site scripting vulnerability (CWE-79). Takayuki Sasaki of Yokohama National University reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
    References
    Impacted products
    Show details on JVN DB website
    To clipboard 

    {
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000107.html",
  "dc:date": "2021-11-30T14:49+09:00",
  "dcterms:issued": "2021-11-30T14:49+09:00",
  "dcterms:modified": "2021-11-30T14:49+09:00",
  "description": "Wi-Fi STATION SH-52A provided by NTT DOCOMO, INC. contains a cross-site scripting vulnerability (CWE-79).\r\n\r\nTakayuki Sasaki of Yokohama National University reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000107.html",
  "sec:cpe": {
    "#text": "cpe:/o:nttdocomo:wi-fi_station_sh-52a_firmware",
    "@product": "Wi-Fi STATION SH-52A",
    "@vendor": "NTT DOCOMO, INC.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "2.3",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:A/AC:M/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "2.9",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000107",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN19482703/index.html",
      "@id": "JVN#19482703",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20847",
      "@id": "CVE-2021-20847",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20847",
      "@id": "CVE-2021-20847",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Wi-Fi STATION SH-52A vulnerable to cross-site scripting"
}

    CVE-2021-20847 (GCVE-0-2021-20847)

    Vulnerability from nvd – Published: 2021-12-01 02:15 – Updated: 2024-08-03 17:53
    VLAI
    Summary
    Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C) allows a remote unauthenticated attacker to inject an arbitrary script via WebUI of the device.
    Severity
    No CVSS data available.
    CWE
    • Cross-site scripting
    Assigner
    References
    Impacted products
    Vendor Product Version
    NTT DOCOMO, INC. Wi-Fi STATION SH-52A Affected: 38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:22.731Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.nttdocomo.co.jp/support/product_update/sh52a/index.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN19482703/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Wi-Fi STATION SH-52A",
          "vendor": "NTT DOCOMO, INC.",
          "versions": [
            {
              "status": "affected",
              "version": "38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C) allows a remote unauthenticated attacker to inject an arbitrary script via WebUI of the device."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-01T02:15:37.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.nttdocomo.co.jp/support/product_update/sh52a/index.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN19482703/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20847",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Wi-Fi STATION SH-52A",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NTT DOCOMO, INC."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C) allows a remote unauthenticated attacker to inject an arbitrary script via WebUI of the device."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.nttdocomo.co.jp/support/product_update/sh52a/index.html",
              "refsource": "MISC",
              "url": "https://www.nttdocomo.co.jp/support/product_update/sh52a/index.html"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN19482703/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN19482703/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20847",
    "datePublished": "2021-12-01T02:15:37.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:53:22.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2021-20847 (GCVE-0-2021-20847)

    Vulnerability from cvelistv5 – Published: 2021-12-01 02:15 – Updated: 2024-08-03 17:53
    VLAI
    Summary
    Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C) allows a remote unauthenticated attacker to inject an arbitrary script via WebUI of the device.
    Severity
    No CVSS data available.
    CWE
    • Cross-site scripting
    Assigner
    References
    Impacted products
    Vendor Product Version
    NTT DOCOMO, INC. Wi-Fi STATION SH-52A Affected: 38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:22.731Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.nttdocomo.co.jp/support/product_update/sh52a/index.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN19482703/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Wi-Fi STATION SH-52A",
          "vendor": "NTT DOCOMO, INC.",
          "versions": [
            {
              "status": "affected",
              "version": "38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C) allows a remote unauthenticated attacker to inject an arbitrary script via WebUI of the device."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-01T02:15:37.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.nttdocomo.co.jp/support/product_update/sh52a/index.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN19482703/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20847",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Wi-Fi STATION SH-52A",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NTT DOCOMO, INC."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C) allows a remote unauthenticated attacker to inject an arbitrary script via WebUI of the device."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.nttdocomo.co.jp/support/product_update/sh52a/index.html",
              "refsource": "MISC",
              "url": "https://www.nttdocomo.co.jp/support/product_update/sh52a/index.html"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN19482703/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN19482703/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20847",
    "datePublished": "2021-12-01T02:15:37.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:53:22.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}