CVE-2022-4874 Authenticated bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows unauthenticated user to get access to content.

2023-01-1120:39:25

certcc

www.cve.org

netcomm router

authenticated bypass

nf20mesh

nf20

nl1902

static content

fake login

vulnerability

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.1%

JSON

Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, the application performs a check for the existence of specific characters in the URL (.css, .png etc). If it exists, it performs a “fake login” to give the request an active session to load the file and not redirect to the login page.

CNA Affected

[
  {
    "vendor": "Netcomm",
    "product": "NF20",
    "versions": [
      {
        "status": "affected",
        "version": "R6B025"
      }
    ]
  },
  {
    "vendor": "Netcomm",
    "product": "NF20MESH",
    "versions": [
      {
        "status": "affected",
        "version": "R6B025"
      }
    ]
  },
  {
    "vendor": "Netcomm",
    "product": "NL1902",
    "versions": [
      {
        "status": "affected",
        "version": "R6B025"
      }
    ]
  }
]