On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.
References
| Link | Resource |
|---|---|
| https://mads.uniud.it/2022/09/lord-of-the-orings/ | Exploit Mitigation Third Party Advisory |
| https://mads.uniud.it/2022/09/lord-of-the-orings/ | Exploit Mitigation Third Party Advisory |
Configurations
History
21 Nov 2024, 07:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://mads.uniud.it/2022/09/lord-of-the-orings/ - Exploit, Mitigation, Third Party Advisory |
02 Nov 2022, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot. | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
21 Oct 2022, 20:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:oringnet:iap-420:-:*:*:*:*:*:*:* cpe:2.3:o:oringnet:iap-420_firmware:2.0m:*:*:*:*:*:*:* cpe:2.3:o:oringnet:iap-420\+_firmware:2.0m:*:*:*:*:*:*:* cpe:2.3:h:oringnet:iap-420\+:-:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | (CONFIRM) https://mads.uniud.it/2022/09/lord-of-the-orings/ - Exploit, Mitigation, Third Party Advisory |
21 Oct 2022, 13:33
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-10-21 13:15
Updated : 2024-11-21 07:19
NVD link : CVE-2022-3203
Mitre link : CVE-2022-3203
CVE.ORG link : CVE-2022-3203
JSON object : View
Products Affected
oringnet
- iap-420_firmware
- iap-420\+_firmware
- iap-420\+
- iap-420
CWE
CWE-912
Hidden Functionality