Vulnerability-Lookup

VAR-201604-0669

Vulnerability from variot - Updated: 2022-05-17 02:04

LGNASN1A1 is a network storage device developed by Korea LG Group. The Familycast service in LGNASN1A110119 has arbitrary file upload/download, secure bypass, SQL injection and unauthorized operation vulnerabilities. Attackers can use these vulnerabilities to upload or download arbitrary files, execute arbitrary script code, bypass security restrictions, access or modify. Data, exploiting potential vulnerabilities in the underlying database, gaining permissions, and performing unauthorized operations. There are multiple security vulnerabilities in the Familycast service in LG NAS N1A1 version 10119

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201604-0669",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "nas n1a1",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "lg",
        "version": "10119"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2016-05130"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Gergely Eberhardt from SEARCH-LAB Ltd.",
    "sources": [
      {
        "db": "BID",
        "id": "90763"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201607-467"
      }
    ],
    "trust": 0.9
  },
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2016-05130",
            "impactScore": 8.5,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "CNVD",
            "id": "CNVD-2016-05130",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2016-05130"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "LGNASN1A1 is a network storage device developed by Korea LG Group. The Familycast service in LGNASN1A110119 has arbitrary file upload/download, secure bypass, SQL injection and unauthorized operation vulnerabilities. Attackers can use these vulnerabilities to upload or download arbitrary files, execute arbitrary script code, bypass security restrictions, access or modify. Data, exploiting potential vulnerabilities in the underlying database, gaining permissions, and performing unauthorized operations. \nThere are multiple security vulnerabilities in the Familycast service in LG NAS N1A1 version 10119",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2016-05130"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201607-467"
      },
      {
        "db": "BID",
        "id": "90763"
      }
    ],
    "trust": 1.35
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "90763",
        "trust": 1.5
      },
      {
        "db": "CNVD",
        "id": "CNVD-2016-05130",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201607-467",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2016-05130"
      },
      {
        "db": "BID",
        "id": "90763"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201607-467"
      }
    ]
  },
  "id": "VAR-201604-0669",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2016-05130"
      }
    ],
    "trust": 1.6
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2016-05130"
      }
    ]
  },
  "last_update_date": "2022-05-17T02:04:32.816000Z",
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 0.9,
        "url": "http://www.lg.com/us/support-product/lg-n1a1dd1"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/90763"
      },
      {
        "trust": 0.3,
        "url": "https://github.com/ebux/lg-nas-n1a1-vulnerabilities"
      },
      {
        "trust": 0.3,
        "url": "http://www.search-lab.hu/advisories/113-secadv-20160519"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2016-05130"
      },
      {
        "db": "BID",
        "id": "90763"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201607-467"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2016-05130"
      },
      {
        "db": "BID",
        "id": "90763"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201607-467"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-07-21T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2016-05130"
      },
      {
        "date": "2016-04-10T00:00:00",
        "db": "BID",
        "id": "90763"
      },
      {
        "date": "2016-04-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201607-467"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-07-21T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2016-05130"
      },
      {
        "date": "2016-07-06T14:44:00",
        "db": "BID",
        "id": "90763"
      },
      {
        "date": "2016-07-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201607-467"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201607-467"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple security vulnerabilities exist in LG NAS N1A1",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2016-05130"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "lack of information",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201607-467"
      }
    ],
    "trust": 0.6
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201604-0669

Tags

Sightings

Nomenclature