CVE-2022-29593

2022-07-1415:15:08

CWE-294

[email protected]

web.nvd.nist.gov

dingtian dt-r002

relay devices

firmware 3.1.276a

http post requests

authentication

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.006

Percentile

79.3%

JSON

relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need for authentication or a valid signed/authorized request.

Affected configurations

Nvd

Node

dingtian-techdt-r004_firmwareMatch3.1.276a

AND

dingtian-techdt-r004Match-

VendorProductVersionCPE
dingtian-techdt-r004_firmware3.1.276acpe:2.3:o:dingtian-tech:dt-r004_firmware:3.1.276a:*:*:*:*:*:*:*
dingtian-techdt-r004-cpe:2.3:h:dingtian-tech:dt-r004:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dingtian-tech	dt-r004_firmware	3.1.276a	cpe:2.3:o:dingtian-tech:dt-r004_firmware:3.1.276a:::::::*
dingtian-tech	dt-r004	-	cpe:2.3:h:dingtian-tech:dt-r004:-:::::::*