9.8

CVE-2022-24693

Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Baicells ≫ Nova436q Firmware Version <= qrtb_2.7.8
   Baicells ≫ Nova436q Version-
Baicells ≫ Neutrino 430 Firmware Version <= qrtb_2.7.8
   Baicells ≫ Neutrino 430 Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.27% 0.868
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.8 10 6.9
AV:N/AC:L/Au:N/C:C/I:N/A:N
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

https://github.com/lukejenkins/CVE-2022-24693
Third Party Advisory
https://img.baicells.com/Upload/20210909/FILE/98d2752f-6e83-49b1-9dab-d291e9023db6.pdf
Third Party Advisory
Release Notes
https://na.baicells.com/Service/Firmware
Vendor Advisory