Lucene search

MitreCVE-2022-31210

HistoryJul 17, 2022 - 11:15 p.m.

CVE-2022-31210

2022-07-1723:15:08

CWE-798

mitre

web.nvd.nist.gov

infiray

iray-a8z3

1.0.957

unauthorized access

hardcoded credentials

backdoor accounts

nvd

cve-2022-31210

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

58.3%

JSON

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/set_param.cgi contains hardcoded credentials to the web application. Because these accounts cannot be deactivated or have their passwords changed, they are considered to be backdoor accounts.

Affected configurations

Nvd

Node

infirayiray-a8z3_firmwareMatch1.0.957

AND

infirayiray-a8z3Match-

VendorProductVersionCPE
infirayiray-a8z3_firmware1.0.957cpe:2.3:o:infiray:iray-a8z3_firmware:1.0.957:*:*:*:*:*:*:*
infirayiray-a8z3-cpe:2.3:h:infiray:iray-a8z3:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
infiray	iray-a8z3_firmware	1.0.957	cpe:2.3:o:infiray:iray-a8z3_firmware:1.0.957:::::::*
infiray	iray-a8z3	-	cpe:2.3:h:infiray:iray-a8z3:-:::::::*

References

sec-consult.com/vulnerability-lab/advisory/infiray-iray-thermal-camera-multiple-vulnerabilities/

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

58.3%

JSON

Related for CVE-2022-31210