Lucene search

K
cve[email protected]CVE-2022-36159
HistorySep 26, 2022 - 11:15 a.m.

CVE-2022-36159

2022-09-2611:15:09
CWE-798
web.nvd.nist.gov
36
6
contec fxa3200
cve-2022-36159
hardcoded password
lan security
vulnerability
nvd

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.0%

Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As the password strength is weak, it can be cracked in few minutes. Through this credential, a malicious actor can access the Wireless LAN Manager interface and open the telnet port then sniff the traffic or inject any malware.

Affected configurations

NVD
Node
contecfxa3000_firmwareRange1.13.00
AND
contecfxa3000Match-
Node
contecfxa3020_firmwareRange1.13.00
AND
contecfxa3020Match-
Node
contecfxa3200_firmwareRange1.13.00
AND
contecfxa3200Match-
Node
contecfxa2000_firmwareRange<1.39.00
AND
contecfxa2000Match-

Social References

More

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.0%

Related for CVE-2022-36159