Hiroshi Kumagai

Name of the Vulnerable Software and Affected Versions: SumaHo application versions 3.0.0 and earlier SumaHo "driving capability" diagnosis result transmission application versions 1.2.2 and earlier Description: The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information by leveraging failure to verify SSL/TLS server certificates. Recommendations: For SumaHo application versions 3.0.0 and earlier, update the application to verify SSL/TLS server certificates. For SumaHo "driving capability" diagnosis result transmission application versions 1.2.2 and earlier, update the application to verify SSL/TLS server certificates.

The issue allows man-in-the-middle attackers to obtain sensitive information from encrypted communications by using a crafted certificate, as Smartphone Passbook does not verify X.509 certificates from SSL servers.

The issue allows attackers to obtain sensitive information by reading a log file that contains input data from the user. This is because the application creates a log file with user input, which can be accessed by attackers.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility of the affected routers. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests, including initializing settings or rebooting the device.