Untrusted search path in Toshiba Lighting & Technology Corporation Installer for…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-426.
Summary
Untrusted search path vulnerability in installers of the software for SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool V1.00.03 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Configuration Software V3.0.2 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WE series<W-03>) V3.00.01, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WD/WC series<W-02>) V2.00.03 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Software Update tool (SD-WB/WL series) V1.00.04 and earlier, SDHC Memory Card with embedded TransferJet functionality Configuration Software V1.02 and earlier, SDHC Memory Card with embedded TransferJet functionality Software Update tool V1.00.06 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Toshiba Lighting & Technology Corporation | Installer for SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool | up to V1.00.03 | — | No fix listed | CNA |
| Toshiba Lighting & Technology Corporation | Installer for SDHC Memory Card with embedded wireless LAN functionality FlashAirTM Configuration Software | up to V3.0.2 | — | No fix listed | CNA |
| Toshiba Lighting & Technology Corporation | Installer for SDHC Memory Card with embedded wireless LAN functionality FlashAirTM Software Update tool (SD-WE series<W-03>) | V3.00.01 | — | No fix listed | CNA |
| Toshiba Lighting & Technology Corporation | Installer for SDHC Memory Card with embedded wireless LAN functionality FlashAirTM Software Update tool (SD-WD/WC series<W-02>) | up to V2.00.03 | — | No fix listed | CNA |
| Toshiba Lighting & Technology Corporation | Installer for SDHC Memory Card with embedded wireless LAN functionality FlashAirTM Software Update tool (SD-WB/WL series) | up to V1.00.04 | — | No fix listed | CNA |
| Toshiba Lighting & Technology Corporation | Installer for SDHC Memory Card with embedded TransferJetTM functionality Configuration Software | up to V1.02 | — | No fix listed | CNA |
| Toshiba Lighting & Technology Corporation | Installer for SDHC Memory Card with embedded TransferJetTM functionality Software Update tool | up to V1.00.06 | — | No fix listed | CNA |
- Installer for SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool VendorToshiba Lighting & Technology Corporation Affected up to V1.00.03 Fixed in — No fix listed CNA
- Installer for SDHC Memory Card with embedded wireless LAN functionality FlashAirTM Configuration Software VendorToshiba Lighting & Technology Corporation Affected up to V3.0.2 Fixed in — No fix listed CNA
- Installer for SDHC Memory Card with embedded wireless LAN functionality FlashAirTM Software Update tool (SD-WE series<W-03>) VendorToshiba Lighting & Technology Corporation Affected V3.00.01 Fixed in — No fix listed CNA
- Installer for SDHC Memory Card with embedded wireless LAN functionality FlashAirTM Software Update tool (SD-WD/WC series<W-02>) VendorToshiba Lighting & Technology Corporation Affected up to V2.00.03 Fixed in — No fix listed CNA
- Installer for SDHC Memory Card with embedded wireless LAN functionality FlashAirTM Software Update tool (SD-WB/WL series) VendorToshiba Lighting & Technology Corporation Affected up to V1.00.04 Fixed in — No fix listed CNA
- Installer for SDHC Memory Card with embedded TransferJetTM functionality Configuration Software VendorToshiba Lighting & Technology Corporation Affected up to V1.02 Fixed in — No fix listed CNA
- Installer for SDHC Memory Card with embedded TransferJetTM functionality Software Update tool VendorToshiba Lighting & Technology Corporation Affected up to V1.00.06 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:toshiba:flashair:*:*:*:*:*:*:*:* | up to 1.00.03; up to 1.00.04; up to 1.00.06; up to 1.02; up to 2.00.03; up to 3.00.01; up to 3.0.2 | Vulnerable | Toshiba Lighting & Technology Corporation |
- cpe:2.3:a:toshiba:flashair:*:*:*:*:*:*:*:* Versions up to 1.00.03; up to 1.00.04; up to 1.00.06; up to 1.02; up to 2.00.03; up to 3.00.01; up to 3.0.2 Vulnerable ·Toshiba Lighting & Technology Corporation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2149
- 2026-10-03 Alias added: GHSA-pvr8-f2qg-6jxg
References
More Toshiba Lighting & Technology Corporation Flashair vulnerabilities
- TI-2017-01463 FlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier and FlashAirTM… CVSS 3.0MEDIUM 4.3
- TI-2016-04206 Improper authentication in Toshiba Lighting & Technology Corporation FlashAir SD-WD/WC… CVSS 3.0MEDIUM 4.3
- TI-2017-01462 FlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier and FlashAirTM… CVSS 3.0LOW 3.5
Sources
- CVE-2017-2149 · CVE Program
- CVE-2017-2149 · NVD
- FIRST EPSS
- GHSA-pvr8-f2qg-6jxg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences