CVE-2022-23765

This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.

Score

CVSS 3.1 8.8 High

Status

Modified - vuln@krcert.or.kr

Published

2022-08-17

Last modified

2024-08-03

Weaknesses

CWE-352

Affected products

• Nas1dual (Efm Networks Co.ltd)
• Nas2dual (Efm Networks Co.ltd)
• Nas4dual (Efm Networks Co.ltd)
• Nas1dual Firmware (Iptime)
• Nas2dual Firmware (Iptime)
• Nas4dual Firmware (Iptime)

References

• https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66877