On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.
References
| Link | Resource |
|---|---|
| https://mads.uniud.it/2022/09/lord-of-the-orings/ | Exploit Mitigation Third Party Advisory |
Configurations
History
02 Nov 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot. | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
21 Oct 2022, 20:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:oringnet:iap-420\+_firmware:2.0m:*:*:*:*:*:*:* cpe:2.3:o:oringnet:iap-420_firmware:2.0m:*:*:*:*:*:*:* cpe:2.3:h:oringnet:iap-420:-:*:*:*:*:*:*:* cpe:2.3:h:oringnet:iap-420\+:-:*:*:*:*:*:*:* |
|
| References | (CONFIRM) https://mads.uniud.it/2022/09/lord-of-the-orings/ - Exploit, Mitigation, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Oringnet iap-420
Oringnet Oringnet iap-420\+ Oringnet iap-420 Firmware Oringnet iap-420\+ Firmware |
21 Oct 2022, 13:33
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-21 13:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-3203
Mitre link : CVE-2022-3203
CVE.ORG link : CVE-2022-3203
JSON object : View
Products Affected
oringnet
- iap-420\+_firmware
- iap-420\+
- iap-420_firmware
- iap-420
CWE
CWE-912
Hidden Functionality