CRITICAL🇵🇱 Wersja polska

CVE-2022-3203

CVSS 9.8v3.1pub. 2022-10-21upd. 2024-11-21

On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Oringnet Iap 420

    HW
    Oringnet
    wszystkie wersje

  • Oringnet Iap 420\+

    HW
    Oringnet
    wszystkie wersje

  • Oringnet Iap 420 Firmware

    OS
    Oringnet
    2.0m

  • Oringnet Iap 420\+ Firmware

    OS
    Oringnet
    2.0m
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2024-55547CRITICAL9.3PL ✓ten sam produkt

Command Injection w ORing IAP-420 via NET-SNMP — dostęp bez uwierzytelnienia

CVE-2024-55544HIGH8.7ten sam produkt

Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS leve...

CVE-2024-55545HIGH7.1ten sam produkt

Missing input validation in the ORing IAP-420 web-interface allows Cross-Site Scripting (XSS).This issue affec...

CVE-2024-55546HIGH7.1ten sam produkt

Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issu...

CVE-2024-5411HIGH8.7ten sam produkt

Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows aut...