CVE-2016-1206 - Vulnerability Details

Vendors	Products
Iodata	Wn-gdn\/r3 Wn-gdn\/r3-c Wn-gdn\/r3-s Wn-gdn\/r3-u Wn-gdn\/r3 Firmware

Link	Providers
http://jvn.jp/en/jp/JVN25674893/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061
http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-05-11T00:00:00", "descriptions": [{"lang": "en", "value": "The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-05-14T16:57:01", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert"}, "references": [{"name": "JVN#25674893", "tags": ["third-party-advisory", "x_refsource_JVN"], "url": "http://jvn.jp/en/jp/JVN25674893/index.html"}, {"name": "JVNDB-2016-000061", "tags": ["third-party-advisory", "x_refsource_JVNDB"], "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2016-1206", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "JVN#25674893", "refsource": "JVN", "url": "http://jvn.jp/en/jp/JVN25674893/index.html"}, {"name": "JVNDB-2016-000061", "refsource": "JVNDB", "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061"}, {"name": "http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/", "refsource": "CONFIRM", "url": "http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T22:48:13.510Z"}, "title": "CVE Program Container", "references": [{"name": "JVN#25674893", "tags": ["third-party-advisory", "x_refsource_JVN", "x_transferred"], "url": "http://jvn.jp/en/jp/JVN25674893/index.html"}, {"name": "JVNDB-2016-000061", "tags": ["third-party-advisory", "x_refsource_JVNDB", "x_transferred"], "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/"}]}]}, "cveMetadata": {"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2016-1206", "datePublished": "2016-05-14T16:00:00", "dateReserved": "2015-12-26T00:00:00", "dateUpdated": "2024-08-05T22:48:13.510Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : n/a (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

datePublic : 2016-05-11T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : n/a (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2016-05-14T16:57:01 (string)

orgId : ede6fdc4-6654-4307-a26d-3331c018e2ce (string)

shortName : jpcert (string)

}

references : [ »

0 : { »

name : JVN#25674893 (string)

tags : [ »

0 : third-party-advisory (string)

1 : x_refsource_JVN (string)

]

url : http://jvn.jp/en/jp/JVN25674893/index.html (string)

}

1 : { »

name : JVNDB-2016-000061 (string)

tags : [ »

0 : third-party-advisory (string)

1 : x_refsource_JVNDB (string)

]

url : http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061 (string)

}

2 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/ (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : vultures@jpcert.or.jp (string)

ID : CVE-2016-1206 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : n/a (string)

version : { »

version_data : [ »

0 : { »

version_value : n/a (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : n/a (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : JVN#25674893 (string)

refsource : JVN (string)

url : http://jvn.jp/en/jp/JVN25674893/index.html (string)

}

1 : { »

name : JVNDB-2016-000061 (string)

refsource : JVNDB (string)

url : http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061 (string)

}

2 : { »

name : http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/ (string)

refsource : CONFIRM (string)

url : http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/ (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T22:48:13.510Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : JVN#25674893 (string)

tags : [ »

0 : third-party-advisory (string)

1 : x_refsource_JVN (string)

2 : x_transferred (string)

]

url : http://jvn.jp/en/jp/JVN25674893/index.html (string)

}

1 : { »

name : JVNDB-2016-000061 (string)

tags : [ »

0 : third-party-advisory (string)

1 : x_refsource_JVNDB (string)

2 : x_transferred (string)

]

url : http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061 (string)

}

2 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/ (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : ede6fdc4-6654-4307-a26d-3331c018e2ce (string)

assignerShortName : jpcert (string)

cveId : CVE-2016-1206 (string)

datePublished : 2016-05-14T16:00:00 (string)

dateReserved : 2015-12-26T00:00:00 (string)

dateUpdated : 2024-08-05T22:48:13.510Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:iodata:wn-gdn\\/r3_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "F4CB7025-E3A5-49DE-95B9-639C3EE65807", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:iodata:wn-gdn\\/r3:-:*:*:*:*:*:*:*", "matchCriteriaId": "C73832A9-39D1-4C1A-811D-837344A151D5", "vulnerable": false}, {"criteria": "cpe:2.3:h:iodata:wn-gdn\\/r3-c:-:*:*:*:*:*:*:*", "matchCriteriaId": "B693C2CD-528C-44D5-BB6B-86DA0D69426C", "vulnerable": false}, {"criteria": "cpe:2.3:h:iodata:wn-gdn\\/r3-s:-:*:*:*:*:*:*:*", "matchCriteriaId": "ABBAED3B-F1EC-4E19-BD67-0F9C5799A299", "vulnerable": false}, {"criteria": "cpe:2.3:h:iodata:wn-gdn\\/r3-u:-:*:*:*:*:*:*:*", "matchCriteriaId": "8C06B002-4EC1-466E-A96B-E0475642912E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack."}, {"lang": "es", "value": "La implementaci\u00f3n WPS en dispositivos I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S y WN-GDN/R3-U no limita conjeturas de PIN, lo que permite a atacantes remotos obtener acceso a la red a trav\u00e9s de un ataque de fuerza bruta."}], "id": "CVE-2016-1206", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-05-14T16:59:00.133", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "http://jvn.jp/en/jp/JVN25674893/index.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://jvn.jp/en/jp/JVN25674893/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:iodata:wn-gdn\/r3_firmware:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F4CB7025-E3A5-49DE-95B9-639C3EE65807 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:iodata:wn-gdn\/r3:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C73832A9-39D1-4C1A-811D-837344A151D5 (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:h:iodata:wn-gdn\/r3-c:-:*:*:*:*:*:*:* (string)

matchCriteriaId : B693C2CD-528C-44D5-BB6B-86DA0D69426C (string)

vulnerable : false (boolean)

}

2 : { »

criteria : cpe:2.3:h:iodata:wn-gdn\/r3-s:-:*:*:*:*:*:*:* (string)

matchCriteriaId : ABBAED3B-F1EC-4E19-BD67-0F9C5799A299 (string)

vulnerable : false (boolean)

}

3 : { »

criteria : cpe:2.3:h:iodata:wn-gdn\/r3-u:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 8C06B002-4EC1-466E-A96B-E0475642912E (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack. (string)

}

1 : { »

lang : es (string)

value : La implementación WPS en dispositivos I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S y WN-GDN/R3-U no limita conjeturas de PIN, lo que permite a atacantes remotos obtener acceso a la red a través de un ataque de fuerza bruta. (string)

}

]

id : CVE-2016-1206 (string)

lastModified : 2025-04-12T10:46:40.837 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : LOW (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : ADJACENT_NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 3.3 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:A/AC:L/Au:N/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 6.5 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : ADJACENT_NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2016-05-14T16:59:00.133 (string)

references : [ »

0 : { »

source : vultures@jpcert.or.jp (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : http://jvn.jp/en/jp/JVN25674893/index.html (string)

}

1 : { »

source : vultures@jpcert.or.jp (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061 (string)

}

2 : { »

source : vultures@jpcert.or.jp (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/ (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : http://jvn.jp/en/jp/JVN25674893/index.html (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : http://jvndb.jvn.jp/jvndb/JVNDB-2016-000061 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/ (string)

}

]

sourceIdentifier : vultures@jpcert.or.jp (string)

vulnStatus : Deferred (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-200 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object