Lucene search

[email protected]NVD:CVE-2022-41489

HistoryOct 13, 2022 - 2:15 p.m.

CVE-2022-41489

2022-10-1314:15:10

CWE-352

[email protected]

web.nvd.nist.gov

wayos

csrf

vulnerability

usb_upload

authentication

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

EPSS

0.001

Percentile

26.3%

JSON

WAYOS LQ_09 22.03.17V was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to send crafted requests to the server from the affected device. This vulnerability is exploitable due to a lack of authentication in the component Usb_upload.htm.

Affected configurations

Nvd

Node

wayoslq-09Match-

AND

wayoslq-09_firmwareMatch22.03.17

Node

wayoslq-08Match-

AND

wayoslq-08_firmwareMatch22.03.17

Node

wayoslq-07Match-

AND

wayoslq-07_firmwareMatch22.03.17

Node

wayoslq-06Match-

AND

wayoslq-06_firmwareMatch22.03.17

Node

wayoslq-05Match-

AND

wayoslq-05_firmwareMatch22.03.17

Node

wayoslq-04Match-

AND

wayoslq-04_firmwareMatch22.03.17

VendorProductVersionCPE
wayoslq-09-cpe:2.3:h:wayos:lq-09:-:*:*:*:*:*:*:*
wayoslq-09_firmware22.03.17cpe:2.3:o:wayos:lq-09_firmware:22.03.17:*:*:*:*:*:*:*
wayoslq-08-cpe:2.3:h:wayos:lq-08:-:*:*:*:*:*:*:*
wayoslq-08_firmware22.03.17cpe:2.3:o:wayos:lq-08_firmware:22.03.17:*:*:*:*:*:*:*
wayoslq-07-cpe:2.3:h:wayos:lq-07:-:*:*:*:*:*:*:*
wayoslq-07_firmware22.03.17cpe:2.3:o:wayos:lq-07_firmware:22.03.17:*:*:*:*:*:*:*
wayoslq-06-cpe:2.3:h:wayos:lq-06:-:*:*:*:*:*:*:*
wayoslq-06_firmware22.03.17cpe:2.3:o:wayos:lq-06_firmware:22.03.17:*:*:*:*:*:*:*
wayoslq-05-cpe:2.3:h:wayos:lq-05:-:*:*:*:*:*:*:*
wayoslq-05_firmware22.03.17cpe:2.3:o:wayos:lq-05_firmware:22.03.17:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wayos	lq-09	-	cpe:2.3:h:wayos:lq-09:-:::::::*
wayos	lq-09_firmware	22.03.17	cpe:2.3:o:wayos:lq-09_firmware:22.03.17:::::::*
wayos	lq-08	-	cpe:2.3:h:wayos:lq-08:-:::::::*
wayos	lq-08_firmware	22.03.17	cpe:2.3:o:wayos:lq-08_firmware:22.03.17:::::::*
wayos	lq-07	-	cpe:2.3:h:wayos:lq-07:-:::::::*
wayos	lq-07_firmware	22.03.17	cpe:2.3:o:wayos:lq-07_firmware:22.03.17:::::::*
wayos	lq-06	-	cpe:2.3:h:wayos:lq-06:-:::::::*
wayos	lq-06_firmware	22.03.17	cpe:2.3:o:wayos:lq-06_firmware:22.03.17:::::::*
wayos	lq-05	-	cpe:2.3:h:wayos:lq-05:-:::::::*
wayos	lq-05_firmware	22.03.17	cpe:2.3:o:wayos:lq-05_firmware:22.03.17:::::::*

Rows per page:

1-10 of 121

References

github.com/splashsc/IOT_Vulnerability_Discovery/blob/main/wayos/wayos_LQ-09%2022_enterprise-class/3_csrf.md

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

EPSS

0.001

Percentile

26.3%

JSON

Related for NVD:CVE-2022-41489

prion1 cvelist1 cve1