CVE-2022-3229

Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated access to run code of the attacker's choosing.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@rapid7.com

Published

2023-02-06

Last modified

2025-03-25

Weaknesses

CWE-285, CWE-306

Affected products

• Unified Remote (Unified Intents Ab)
• Unified Remote (Unifiedremote)

References

• https://github.com/rapid7/metasploit-framework/pull/16989