CVE-2017-2149
First published: Fri Apr 28 2017(Updated: )
Untrusted search path vulnerability in installers of the software for SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool V1.00.03 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Configuration Software V3.0.2 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WE series<W-03>) V3.00.01, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WD/WC series<W-02>) V2.00.03 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WB/WL series) V1.00.04 and earlier, SDHC Memory Card with embedded TransferJet functionality Configuration Software V1.02 and earlier, SDHC Memory Card with embedded TransferJet functionality Software Update tool V1.00.06 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Credit: vultures@jpcert.or.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Toshiba FlashAir | <=1.00.03 | |
| Toshiba FlashAir | <=1.00.04 | |
| Toshiba FlashAir | <=1.00.06 | |
| Toshiba FlashAir | <=1.02 | |
| Toshiba FlashAir | <=2.00.03 | |
| Toshiba FlashAir | <=3.00.01 | |
| Toshiba FlashAir | <=3.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-2149?
CVE-2017-2149 is considered a high-severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2017-2149?
To mitigate CVE-2017-2149, users should update the affected Toshiba FlashAir software to the latest version.
What types of devices are affected by CVE-2017-2149?
CVE-2017-2149 affects Toshiba FlashAir SDHC/SDXC Memory Cards with embedded NFC and wireless LAN functionality.
What are the potential impacts of CVE-2017-2149?
Exploiting CVE-2017-2149 could allow an attacker to execute arbitrary code with elevated privileges on the affected system.
Is there a workaround for CVE-2017-2149?
Currently, the best course of action is to update the software, as no specific workarounds for CVE-2017-2149 are documented.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/toshiba
- canonical/toshiba flashair
- version/toshiba flashair/1.00.03
- version/toshiba flashair/1.00.04
- version/toshiba flashair/1.00.06
- version/toshiba flashair/1.02
- version/toshiba flashair/2.00.03
- version/toshiba flashair/3.00.01
- version/toshiba flashair/3.0.2