CRITICAL🇬🇧 English

CVE-2022-3203

CVSS 9.8v3.1pub. 2022-10-21upd. 2024-11-21

On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Oringnet Iap 420

    HW
    Oringnet
    wszystkie wersje

  • Oringnet Iap 420\+

    HW
    Oringnet
    wszystkie wersje

  • Oringnet Iap 420 Firmware

    OS
    Oringnet
    2.0m

  • Oringnet Iap 420\+ Firmware

    OS
    Oringnet
    2.0m
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2024-55547CRITICAL9.3PL ✓ten sam produkt

Command Injection w ORing IAP-420 via NET-SNMP — dostęp bez uwierzytelnienia

CVE-2024-55544HIGH8.7ten sam produkt

Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS leve...

CVE-2024-55545HIGH7.1ten sam produkt

Missing input validation in the ORing IAP-420 web-interface allows Cross-Site Scripting (XSS).This issue affec...

CVE-2024-55546HIGH7.1ten sam produkt

Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issu...

CVE-2024-5411HIGH8.7ten sam produkt

Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows aut...