CVE-2016-4863 — The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later, FlashAir III Class 10 model W-03 series, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later, FlashAir W-03 series Class 10 model does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled, which allows attackers with access to STA side LAN can obtain files or data

Back Back to CVE browser

MEDIUM

The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later, FlashAir III Class 10 model W-03 series, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later, FlashAir W-03 series Class 10 model does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled, which allows attackers with access to STA side LAN can obtain files or data

Published May 22, 2017

4.3

MEDIUM

CVSS 3.0

EPSS 0.71%

Description

The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later, FlashAir III Class 10 model W-03 series, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later, FlashAir W-03 series Class 10 model does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled, which allows attackers with access to STA side LAN can obtain files or data.

Affected products

Vendor Toshiba Product FlashAir Class 6 model Default
n/a
- Version
  firmware version 1.00.04 and later
  Status
  affected
  Constraints
  -
Vendor Toshiba Product FlashAir II Class 10 model W-02 series Default
n/a
- Version
  firmware version 2.00.02 and later
  Status
  affected
  Constraints
  -
Vendor Toshiba Product FlashAir III Class 10 model W-03 series Default
n/a
- Version
  all firmware versions
  Status
  affected
  Constraints
  -
Vendor Toshiba Product FlashAir SD-WD/WC series Class 10 model W-02 Default
n/a
- Version
  firmware version 2.00.02 and later
  Status
  affected
  Constraints
  -
Vendor Toshiba Product FlashAir SD-WD/WC series Class 6 model Default
n/a
- Version
  firmware version 1.00.04 and later
  Status
  affected
  Constraints
  -
Vendor Toshiba Product FlashAir SD-WE series Class 10 model W-03 Default
n/a
- Version
  all firmware versions
  Status
  affected
  Constraints
  -
Vendor Toshiba Product FlashAir W-02 series Class 10 model Default
n/a
- Version
  firmware version 2.00.02 and later
  Status
  affected
  Constraints
  -
Vendor Toshiba Product FlashAir W-03 series Class 10 model Default
n/a
- Version
  all firmware versions
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Toshiba

FlashAir Class 6 model

n/a

Version	Status	Constraints
firmware version 1.00.04 and later	affected	-

Toshiba

FlashAir II Class 10 model W-02 series

n/a

Version	Status	Constraints
firmware version 2.00.02 and later	affected	-

Toshiba

FlashAir III Class 10 model W-03 series

n/a

Version	Status	Constraints
all firmware versions	affected	-

Toshiba

FlashAir SD-WD/WC series Class 10 model W-02

n/a

Version	Status	Constraints
firmware version 2.00.02 and later	affected	-

Toshiba

FlashAir SD-WD/WC series Class 6 model

n/a

Version	Status	Constraints
firmware version 1.00.04 and later	affected	-

Toshiba

FlashAir SD-WE series Class 10 model W-03

n/a

Version	Status	Constraints
all firmware versions	affected	-

Toshiba

FlashAir W-02 series Class 10 model

n/a

Version	Status	Constraints
firmware version 2.00.02 and later	affected	-

Toshiba

FlashAir W-03 series Class 10 model

n/a

Version	Status	Constraints
all firmware versions	affected	-

Remediation

No remediation recorded yet.

Metrics

0.71% 0.00711

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00711

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.71% (0.00711)	51.85th	v5 (v2026.06.15)
Jun 15, 2026	0.71% (0.00711)	48.55th	v5 (v2026.06.15)
Mar 17, 2025	0.13% (0.00133)	30.36th	v4 (v2025.03.14)
Dec 12, 2024	0.09% (0.00087)	38.52th	v3 (v2023.03.01)
Jun 22, 2024	0.09% (0.00087)	37.06th	v3 (v2023.03.01)
Mar 7, 2023	0.09% (0.00087)	35.06th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00954)	16.28th	v2 (v2022.01.01)

Weaknesses (1)

CWE-287

Improper Authentication

References (3)

http://jvndb.jvn.jp/jvndb/JVNDB-2016-000168
third-party-advisoryx_refsource_JVNDBThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/93479
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://jvn.jp/en/jp/JVN39619137/index.html
third-party-advisoryx_refsource_JVNThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000168		third-party-advisoryx_refsource_JVNDBThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/93479		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://jvn.jp/en/jp/JVN39619137/index.html		third-party-advisoryx_refsource_JVNThird Party AdvisoryVDB Entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner jpcert

Published May 22, 2017

Updated Aug 6, 2024

Reserved May 17, 2016

Link CVE-2016-4863

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2016-4863

Red Hat

Severity n/a

Public date n/a

Links CVE-2016-4863