Lucene search

INCDCVELIST:CVE-2022-34767

HistoryJul 21, 2022 - 3:37 p.m.

CVE-2022-34767 ALLNET Gmbh - ADSL/VDSL Router inkl. Modem and Wlan Authorization Bypass

2022-07-2115:37:00

INCD

www.cve.org

allnet gmbh

adsl/vdsl

router

authorization bypass

vulnerability

modem

wlan

authorization

CVSS3

5.9

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

57.3%

JSON

Web page which “wizardpwd.asp” ALLNET Router model WR0500AC is prone to Authorization bypass vulnerability – the password, located at “admin” allows changing the http[s]://wizardpwd.asp/cgi-bin. Does not validate the user’s identity and can be accessed publicly.

CNA Affected

[
  {
    "product": "ALLNET Gmbh - ADSL/VDSL Router inkl. Modem and Wlan",
    "vendor": "\t ALLNET Gmbh",
    "versions": [
      {
        "lessThan": "Update to the latest version*",
        "status": "affected",
        "version": "Update to the latest version",
        "versionType": "custom"
      }
    ]
  }
]

References

www.gov.il/en/Departments/faq/cve_advisories