CVE-2022-24693

Опубликовано: 30 мар. 2022

Источник: nvd

CVSS3: 9.8

CVSS2: 7.8

EPSS Низкий

Описание

Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)

Ссылки

https://github.com/lukejenkins/CVE-2022-24693
Third Party Advisory
https://img.baicells.com/Upload/20210909/FILE/98d2752f-6e83-49b1-9dab-d291e9023db6.pdf
Release Notes
Third Party Advisory
https://na.baicells.com/Service/Firmware
Vendor Advisory
https://github.com/lukejenkins/CVE-2022-24693
Third Party Advisory
https://img.baicells.com/Upload/20210909/FILE/98d2752f-6e83-49b1-9dab-d291e9023db6.pdf
Release Notes
Third Party Advisory
https://na.baicells.com/Service/Firmware
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:baicells:nova436q_firmware:*:*:*:*:*:*:*:*

Версия до qrtb_2.7.8 (включая)

cpe:2.3:h:baicells:nova436q:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:baicells:neutrino_430_firmware:*:*:*:*:*:*:*:*

Версия до qrtb_2.7.8 (включая)

cpe:2.3:h:baicells:neutrino_430:-:*:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01281

Низкий

9.8 Critical

CVSS3

7.8 High

CVSS2

Дефекты

CWE-798

Связанные уязвимости

GHSA-7vmv-mpx6-985j