CVEvulnerability

CVE-2022-3203

9.8 CRITICAL Published 2022-10-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-10-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-912

Description

On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.

Affected configurations

• oringnet iap-420\+ firmware 2.0m • oringnet iap-420 firmware 2.0m

Related

Weakness · CWE (1)

  • CWE-912 Hidden Functionality weakness

Referenced by CWE · observed example (2)

  • CWE-1059 Insufficient Technical Documentation weakness
  • CWE-912 Hidden Functionality weakness

References