CRITICAL🇵🇱 Wersja polska

CVE-2022-1039

CVSS 9.6v3.1pub. 2022-04-20upd. 2024-11-21

The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of which is by default enabled on trusted interfaces. While the SSH service does not support root login, a user logging in using either of the other Linux accounts may elevate to root access using the su command if they have access to the associated password.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

  • Redlion Da50n

    HW
    Redlion
    all versions

  • Redlion Da50n Firmware

    OS
    Redlion
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-26516HIGH8.4same product

Authorized users may install a maliciously modified package file when updating the device via the web user int...

CVE-2022-27179MEDIUM4.6same product

A malicious actor having access to the exported configuration file may obtain the stored credentials and there...

CVE-2020-27285CRITICAL9.1PL ✓same vendor

Red Lion Crimson 3.1 — dostęp do bazy danych bez uwierzytelnienia

CVE-2020-16204CRITICAL9.8PL ✓same vendor

Ukryty interfejs w Red Lion N-Tron 702-W umożliwia wykonanie komend jako root

CVE-2020-16206CRITICAL9.0PL ✓same vendor

Stored XSS umożliwiający RCE w Red Lion N-Tron 702-W / 702M12-W