Lucene search

[email protected]CVE-2022-4874

HistoryJan 11, 2023 - 9:15 p.m.

CVE-2022-4874

2023-01-1121:15:10

CWE-287

[email protected]

web.nvd.nist.gov

In Wild

cve-2022-4874

authentication bypass

netcomm router

nf20mesh

nf20

nl1902

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.1%

JSON

Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, the application performs a check for the existence of specific characters in the URL (.css, .png etc). If it exists, it performs a “fake login” to give the request an active session to load the file and not redirect to the login page.

Affected configurations

NVD

Node

netcommwirelessnf20_firmwareRange<r6b025

AND

netcommwirelessnf20Match-

Node

netcommwirelessnf20mesh_firmwareRange<r6b025

AND

netcommwirelessnf20meshMatch-

Node

netcommwirelessnl1902_firmwareRange<r6b025

AND

netcommwirelessnl1902Match-

CPENameOperatorVersion
netcommwireless:nf20_firmwarenetcommwireless nf20 firmwareltr6b025

CPE	Name	Operator	Version
netcommwireless:nf20_firmware	netcommwireless nf20 firmware	lt	r6b025

CNA Affected

[
  {
    "vendor": "Netcomm",
    "product": "NF20",
    "versions": [
      {
        "status": "affected",
        "version": "R6B025"
      }
    ]
  },
  {
    "vendor": "Netcomm",
    "product": "NF20MESH",
    "versions": [
      {
        "status": "affected",
        "version": "R6B025"
      }
    ]
  },
  {
    "vendor": "Netcomm",
    "product": "NL1902",
    "versions": [
      {
        "status": "affected",
        "version": "R6B025"
      }
    ]
  }
]