Auth bypass in Softbank Android Smartphone
CVE-2013-2310
SoftBank Wi-Fi Spot Configuration Software, as used on SoftBank SHARP 3G handsets, SoftBank Panasonic 3G handsets, SoftBank NEC 3G handsets, SoftBank Samsung 3G handsets, SoftBank mobile Wi-Fi routers, SoftBank Android smartphones with the Wi-Fi application before 1.7.1, SoftBank Windows Mobile smartphones with the WISPrClient application before 1.3.1, SoftBank Disney Mobile Android smartphones with the Wi-Fi application before 1.7.1, and WILLCOM Android smartphones with the Wi-Fi application before 1.7.1, does not properly connect to access points, which allows remote attackers to obtain sensitive information by leveraging access to an 802.11 network.
Vulnerability class: Broken Authentication
EPSS: 0.007 (50.4th percentile) — read the EPSS interpretation.
Affected products
- Softbank Android_smartphone — versions 001dl, 001ht, 003p
- Softbank Disney_mobile_android_smartphone — versions dm009sh, dm010sh, dm011sh
- Softbank Mobile_wi-fi_router — versions 101sb, 102hw, 102z
- Softbank Nec_3g_handset — versions 001n, 931n, 940n
- Softbank Panasonic_3g_handset — versions 001p, 941p, 942p
- Softbank Samsung_3g_handset — versions 941sc
- Softbank Sharp_3g_handset — versions 001n, 001p, 002sh
- Softbank Wi-fi_application
- Softbank Wi-fi_spot_configuration_software
- Softbank Windows_mobile_smartphone — versions x01sc, x02t, x04ht
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (x_refsource_CONFIRM)
- vultures@jpcert.or.jp (x_refsource_JVN, third-party-advisory)
- vultures@jpcert.or.jp (x_refsource_CONFIRM)
- vultures@jpcert.or.jp (x_refsource_JVNDB, third-party-advisory)
- vultures@jpcert.or.jp (x_refsource_CONFIRM)