VulnerabilityModified
CVE-2022-36158
Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).
HIGH 8.0EPSS 1.53%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).
- CVSS 3.1
- 8.0 HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.53% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-425
- Affected
- contec/fxa3000 firmware · contec/fxa3020 firmware · contec/fxa3200 firmware · contec/fxa2000 firmware
- Source
- cve@mitre.org
References
- https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4Broken Link, Third Party Advisory
- https://jvn.jp/en/vu/JVNVU98305100/Patch, Third Party Advisory
- https://samy.link/blog/contec-flexlan-fxa2000-and-fxa3000-series-vulnerability-repoExploit, Mitigation, Third Party Advisory
- https://www.contec.com/products-services/computer-networking/flexlan-fx/fx-accesspoint/fxa3200/feature/#sectionProduct
- https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4Broken Link, Third Party Advisory
- https://jvn.jp/en/vu/JVNVU98305100/Patch, Third Party Advisory
- https://samy.link/blog/contec-flexlan-fxa2000-and-fxa3000-series-vulnerability-repoExploit, Mitigation, Third Party Advisory
- https://www.contec.com/products-services/computer-networking/flexlan-fx/fx-accesspoint/fxa3200/feature/#sectionProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.