HIGH🇵🇱 Wersja polska

CVE-2022-4874

CVSS 7.5v3.1pub. 2023-01-11upd. 2025-11-04

Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, the application performs a check for the existence of specific characters in the URL (.css, .png etc). If it exists, it performs a "fake login" to give the request an active session to load the file and not redirect to the login page.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Netcommwireless Nf20

    HW
    Netcommwireless
    all versions

  • Netcommwireless Nf20 Firmware

    OS
    Netcommwireless
    < r6b025

  • Netcommwireless Nf20mesh

    HW
    Netcommwireless
    all versions

  • Netcommwireless Nf20mesh Firmware

    OS
    Netcommwireless
    < r6b025

  • Netcommwireless Nl1902

    HW
    Netcommwireless
    all versions

  • Netcommwireless Nl1902 Firmware

    OS
    Netcommwireless
    < r6b025
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2022-4873CRITICAL9.8PL ✓same product

Stack-based buffer overflow w parametrze sessionKey na routerach Netcomm

CVE-2015-6024CRITICAL9.8PL ✓same vendor

Command injection w ping.cgi routerów NetCommWireless HSPA 3G10WVE

CVE-2018-14782HIGH7.5same vendor

NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device allo...

CVE-2018-14783HIGH8.8same vendor

NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. A cross-site re...

CVE-2018-14785HIGH7.5same vendor

NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The directory o...