Vendor

Kddi

Products

CVEs

Across products

Status

Private

Products

Recent CVEs

CVE	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2017-2186	Hig	0.57	8.8	0.01	Jul 7, 2017	HOME SPOT CUBE2 firmware V101 and earlier allows an attacker to bypass authentication to load malicious firmware via WebUI.
CVE-2017-2185	Hig	0.57	8.8	0.01	Jul 7, 2017	HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via WebUI.
CVE-2017-2184	Hig	0.57	8.8	0.01	Jul 7, 2017	Buffer overflow in HOME SPOT CUBE2 firmware V101 and earlier allows an attacker to execute arbitrary code via WebUI.
CVE-2017-2183	Hig	0.52	8.0	0.01	Jul 7, 2017	HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via Clock Settings.
CVE-2017-2289	Hig	0.51	7.8	0.00	Aug 18, 2017	Untrusted search path vulnerability in Installer of Qua station connection tool for Windows version 1.00.03 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2016-1137	Hig	0.48	7.4	0.00	Jan 30, 2016	Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2016-1140	Med	0.40	6.1	0.00	Jan 30, 2016	KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors.
CVE-2016-1136	Med	0.35	5.4	0.00	Jan 30, 2016	Cross-site scripting (XSS) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-1141	Med	0.31	4.7	0.01	Jan 30, 2016	KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
CVE-2016-1138	Med	0.31	4.7	0.00	Jan 30, 2016	CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors.
CVE-2007-3692		0.00	—	0.01	Jul 11, 2007	Directory traversal vulnerability in download.cgi in EZFactory KDDI Download CGI 1.x allows remote attackers to read and download arbitrary files via a .. (dot dot) in the name parameter.

CVE-2017-2186HigJul 7, 2017
risk 0.57cvss 8.8epss 0.01
HOME SPOT CUBE2 firmware V101 and earlier allows an attacker to bypass authentication to load malicious firmware via WebUI.
CVE-2017-2185HigJul 7, 2017
risk 0.57cvss 8.8epss 0.01
HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via WebUI.
CVE-2017-2184HigJul 7, 2017
risk 0.57cvss 8.8epss 0.01
Buffer overflow in HOME SPOT CUBE2 firmware V101 and earlier allows an attacker to execute arbitrary code via WebUI.
CVE-2017-2183HigJul 7, 2017
risk 0.52cvss 8.0epss 0.01
HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via Clock Settings.
CVE-2017-2289HigAug 18, 2017
risk 0.51cvss 7.8epss 0.00
Untrusted search path vulnerability in Installer of Qua station connection tool for Windows version 1.00.03 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2016-1137HigJan 30, 2016
risk 0.48cvss 7.4epss 0.00
Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2016-1140MedJan 30, 2016
risk 0.40cvss 6.1epss 0.00
KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors.
CVE-2016-1136MedJan 30, 2016
risk 0.35cvss 5.4epss 0.00
Cross-site scripting (XSS) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-1141MedJan 30, 2016
risk 0.31cvss 4.7epss 0.01
KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
CVE-2016-1138MedJan 30, 2016
risk 0.31cvss 4.7epss 0.00
CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors.
CVE-2007-3692Jul 11, 2007
risk 0.00cvss —epss 0.01
Directory traversal vulnerability in download.cgi in EZFactory KDDI Download CGI 1.x allows remote attackers to read and download arbitrary files via a .. (dot dot) in the name parameter.