by Kastro
Paper/Archive/CVE-2022-3203

CVE-2022-3203

ORing IAP-420(+) — ORing net IAP-420(+) Hidden Functionality

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.2.632 × 2012.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.

Affected

ProductAffectedFixed inSource
IAP-420(+)FW 2.0m–CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refmads.uniud.it/2022/09/lord-of-the-orings