CVE-2022-37932

🗓️ 30 Nov 2022 15:23:14Reported by hpeType

cve🔗 web.nvd.nist.gov👁 302 Views🌐 WEB

Potential security vulnerability in Hewlett Packard Enterprise OfficeConnect switche

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for CVE-2022-37932	10 Apr 202503:27	–	githubexploit
Circl	CVE-2022-37932	12 Dec 202216:25	–	circl
CNNVD	Hewlett Packard Enterprise OfficeConnect Authorization Issue Vulnerability	12 Dec 202200:00	–	cnnvd
Cvelist	CVE-2022-37932	30 Nov 202215:23	–	cvelist
EUVD	EUVD-2022-40539	30 Nov 202215:23	–	euvd
HPE Security Bulletins	HPESBNW04383 rev.1 - Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches, Remote Authentication Bypass Vulnerability	16 Nov 202200:00	–	hpe
Kitploit	CVE-2022-37932	31 Oct 202610:13	–	kitploit
NCSC	Vulnerability in HPE OfficeConnect switches	22 Nov 202200:00	–	ncsc
Nuclei	HP Switch - Authentication Bypass	1 Nov 202602:03	–	nuclei
NVD	CVE-2022-37932	12 Dec 202213:15	–	nvd

NVD

Vulners

Node

AND

hpe officeconnect_1820_j9979a_firmwareRange<pt.02.14

hpe officeconnect_1820_j9979aMatch-

Node

AND

hpe officeconnect_1820_j9982a_firmwareRange<pt.02.14

hpe officeconnect_1820_j9982aMatch-

Node

AND

hpe officeconnect_1820_j9980a_firmwareRange<pt.02.14

hpe officeconnect_1820_j9980aMatch-

Node

AND

hpe officeconnect_1820_j9983a_firmwareRange<pt.02.14

hpe officeconnect_1820_j9983aMatch-

Node

AND

hpe officeconnect_1820_j9981a_firmwareRange<pt.02.14

hpe officeconnect_1820_j9981aMatch-

Node

AND

hpe officeconnect_1820_j9984a_firmwareRange<pt.02.14

hpe officeconnect_1820_j9984aMatch-

Node

AND

hpe officeconnect_1850_24g_2xgt_poe+_firmwareRange<pc.01.22

hpe officeconnect_1850_24g_2xgt_poe+Match-

Node

AND

hpe officeconnect_1850_24g_2xgt_firmwareRange<pc.01.22

hpe officeconnect_1850_24g_2xgtMatch-

Node

AND

hpe officeconnect_1850_48g_4xgt_poe+_firmwareRange<pc.01.22

hpe officeconnect_1850_48g_4xgt_poe+Match-

Node

AND

hpe officeconnect_1850_48g_4xgt_firmwareRange<pc.01.22

hpe officeconnect_1850_48g_4xgtMatch-

Node

AND

hpe officeconnect_1850_6xgt_firmwareRange<po.01.21

hpe officeconnect_1850_6xgtMatch-

Node

AND

hpe officeconnect_1850_2xgt/spf+_firmwareRange<po.01.21

hpe officeconnect_1850_2xgt/spf+Match-

Node

AND

hpe officeconnect_1920s_24g_2sfp_poe+_firmwareRange<pd.02.22

hpe officeconnect_1920s_24g_2sfp_poe+Match-

Node

AND

hpe officeconnect_1920s_24g_2sfp_ppoe+_firmwareRange<pd.02.22

hpe officeconnect_1920s_24g_2sfp_ppoe+Match-

Node

AND

hpe officeconnect_1920s_24g_2sfp_firmwareRange<pd.02.22

hpe officeconnect_1920s_24g_2sfpMatch-

Node

AND

hpe officeconnect_1920s_48g_4sfp_ppoe+_firmwareRange<pd.02.22

hpe officeconnect_1920s_48g_4sfp_ppoe+Match-

Node

AND

hpe officeconnect_1920s_48g_4sfp_firmwareRange<pd.02.22

hpe officeconnect_1920s_48g_4sfpMatch-

Node

AND

hpe officeconnect_1920s_8g_ppoe+_firmwareRange<pd.02.22

hpe officeconnect_1920s_8g_ppoe+Match-

Node

AND

hpe officeconnect_1920s_8g_firmwareRange<pd.02.22

hpe officeconnect_1920s_8gMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches",
    "vendor": "Hewlett Packard Enterprise (HPE)",
    "versions": [
      {
        "status": "affected",
        "version": "Prior to PT.02.14; Prior to PC.01.22; Prior to PO.01.21; Prior to PD.02.22;"
      }
    ]
  }
]

Source	Link
support	www.support.hpe.com/hpsc/doc/public/display

Parameter	Position	Path	Description
username	request body	/login/default_password_cfg.lua	Unauthenticated password change via /login/default_password_cfg.lua allowing admin password change without authentication.
oldPwd	request body	/login/default_password_cfg.lua	Unauthenticated password change via /login/default_password_cfg.lua allowing admin password change without authentication.
newPwd	request body	/login/default_password_cfg.lua	Unauthenticated password change via /login/default_password_cfg.lua allowing admin password change without authentication.
confirmPwd	request body	/login/default_password_cfg.lua	Unauthenticated password change via /login/default_password_cfg.lua allowing admin password change without authentication.

17 Jun 2026 04:55Current

7.8High risk

Vulners AI Score7.8

CVSS 3.18.8 - 9.8

EPSS0.02815

SSVC

In Wild