Lucene search
HistoryAug 17, 2022 - 9:15 p.m.
CVE-2022-23765
vulnerability
iptime nas
remote attack
privilege escalation
post request
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
39.7%
This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.
Affected configurations
Node
iptimenas1dual_firmwareRange<1.4.86
iptimenas1dualMatch-
Node
iptimenas2dual_firmwareRange<1.4.86
iptimenas2dualMatch-
Node
iptimenas4dual_firmwareRange<1.4.86
iptimenas4dualMatch-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| iptime | nas1dual_firmware | * | cpe:2.3:o:iptime:nas1dual_firmware:*:*:*:*:*:*:*:* |
| iptime | nas1dual | - | cpe:2.3:h:iptime:nas1dual:-:*:*:*:*:*:*:* |
| iptime | nas2dual_firmware | * | cpe:2.3:o:iptime:nas2dual_firmware:*:*:*:*:*:*:*:* |
| iptime | nas2dual | - | cpe:2.3:h:iptime:nas2dual:-:*:*:*:*:*:*:* |
| iptime | nas4dual_firmware | * | cpe:2.3:o:iptime:nas4dual_firmware:*:*:*:*:*:*:*:* |
| iptime | nas4dual | - | cpe:2.3:h:iptime:nas4dual:-:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2022-23765 IPTIME NAS family CSRF vulnerability
2022-08-17 20:24:23
cve
cve
CVE-2022-23765
2022-08-17 21:15:08
prion
prion
Cross site request forgery (csrf)
2022-08-17 21:15:00
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
39.7%
Related for NVD:CVE-2022-23765