CVE-2022-3203
Critical
Description
On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.
SeverityCritical
CVSS9.8
Exploit probability—
ProductOringnet Iap-420 Firmware
PublishedOct 21, 2022
First seenOct 21, 2022
Weakness typeCWE-912CWE-912
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oringnet iap-420_firmware | 2.0m | — |
| oringnet iap-420\+_firmware | 2.0m | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.