CVE-2022-32985
Critical
Description
libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201.
SeverityCritical
CVSS9.8
Exploit probability—
ProductNexans Gigaswitch 641 Desk V5 Sfp-vi Firmware
PublishedJul 17, 2022
First seenJul 17, 2022
How to fix
Update
- nexans gigaswitch_641_desk_v5_sfp-vi_firmware6.02n, 7.02 or later
- nexans gigaswitch_642_desk_v5_sfp-2vi_firmware6.02n, 7.02 or later
- nexans gigaswitch_v5_2tp\(pd-f\+\)_sfp-vi_54vdc_firmware6.02n, 7.02 or later
- nexans gigaswitch_v5_2tp\(pse\+\)_sfp-vi_54vdc_firmware6.02n, 7.02 or later
- nexans gigaswitch_v5_2tp_sfp-vi_54vdc_firmware6.02n, 7.02 or later
- nexans gigaswitch_v5_sfp-2vi_230vac_firmware6.02n, 7.02 or later
- nexans gigaswitch_v5_tp\(pse\+\)_sfp-2vi_54vdc_firmware6.02n, 7.02 or later
- nexans gigaswitch_v5_tp\(pse\+\)_sfp-2vi_54vdc_ind_firmware6.02n, 7.02 or later
- nexans gigaswitch_v5_tp\(pse\+\)_sfp-2vi_54vdc_med_firmware6.02n, 7.02 or later
- nexans gigaswitch_v5_tp_sfp-2vi_54vdc_firmware6.02n, 7.02 or later
- nexans gigaswitch_v5_tp_sfp-2vi_54vdc_ind_firmware6.02n, 7.02 or later
- nexans gigaswitch_v5_tp_sfp-2vi_54vdc_med_firmware6.02n, 7.02 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nexans gigaswitch_641_desk_v5_sfp-vi_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_642_desk_v5_sfp-2vi_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_v5_2tp\(pd-f\+\)_sfp-vi_54vdc_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_v5_2tp\(pse\+\)_sfp-vi_54vdc_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_v5_2tp_sfp-vi_54vdc_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_v5_sfp-2vi_230vac_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_v5_tp\(pse\+\)_sfp-2vi_54vdc_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_v5_tp\(pse\+\)_sfp-2vi_54vdc_ind_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_v5_tp\(pse\+\)_sfp-2vi_54vdc_med_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_v5_tp_sfp-2vi_54vdc_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_v5_tp_sfp-2vi_54vdc_ind_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_v5_tp_sfp-2vi_54vdc_med_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
| nexans gigaswitch_v5_tp_sfp-vi_230vac_firmware | v < 6.02n, 7.0 ≤ v < 7.02 | 6.02n, 7.02 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.