Lucene search

[email protected]NVD:CVE-2022-38625

HistoryAug 29, 2022 - 11:15 p.m.

CVE-2022-38625

2022-08-2923:15:08

CWE-345

[email protected]

web.nvd.nist.gov

patlite nh-fb

firmware validation

upgrade process

authenticated attackers

malicious code

design choice

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

68.3%

JSON

Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability allows authenticated attackers to create and upload their own custom-built firmware and inject malicious code. NOTE: the vendor’s position is that this is a design choice, not a vulnerability

Affected configurations

NVD

Node

patlitenbm-d88n_firmwareRange≤1.46

AND

patlitenbm-d88nMatch-

Node

patlitenhl-3fb1_firmwareRange≤1.46

AND

patlitenhl-3fb1Match-

Node

patlitenhl-3fv1n_firmwareRange≤1.46

AND

patlitenhl-3fv1nMatch-

References

gist.github.com/Nwqda/dfad4e11b545dd40aebca6031d202f66

www.patlite.com/network-products/lineup/nh-fb.html

www.youtube.com/watch?v=4r9FH6U2VR8

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

68.3%

JSON

Related for NVD:CVE-2022-38625

cve1 prion1 cvelist1