CVE-2016-4863

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later, FlashAir III Class 10 model W-03 series, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later, FlashAir W-03 series Class 10 model does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled, which allows attackers with access to STA side LAN can obtain files or data.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
ToshibaFlashAir SD-WD/WC series Class 6 modelfirmware version 1.00.04 and later
ToshibaFlashAir SD-WD/WC series Class 10 model W-02firmware version 2.00.02 and later
ToshibaFlashAir SD-WE series Class 10 model W-03all firmware versions
ToshibaFlashAir Class 6 modelfirmware version 1.00.04 and later
ToshibaFlashAir II Class 10 model W-02 seriesfirmware version 2.00.02 and later
ToshibaFlashAir III Class 10 model W-03 seriesall firmware versions
ToshibaFlashAir Class 6 modelfirmware version 1.00.04 and later
ToshibaFlashAir W-02 series Class 10 modelfirmware version 2.00.02 and later
ToshibaFlashAir W-03 series Class 10 modelall firmware versions

References

Timeline

Published
May 22, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-48647.5H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specCVE-2016-48654.8Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web scripCVE-2016-48664.8Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web scripCVE-2016-48674.3Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized project information viCVE-2016-48684.3Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send uninCVE-2016-48696.5Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed.CVE-2016-48705.4Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or CVE-2016-48716.5Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service.CVE-2016-48724.3Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projectsCVE-2016-48734.3Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project function.CVE-2016-48743.5Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack.CVE-2016-48756.1Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataBox plugin before 0.0.
CVE-2016-4863: Medium severity, CVSS 4.3 | Vulnix