Vulnerability · Published Feb 6, 2023 · Assigned by rapid7

CVE-2022-3229

Critical 9.8

In plain English

A critical-severity missing authentication in Unified Remote from Unified Intents AB. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 66.4% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)66.4%top 0.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Metasploit

Official description

Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated access to run code of the attacker's choosing.

Affected products (as reported)

Vendor	Product	Versions
Unified Intents AB	Unified Remote	0 – through 3.11.0.2483 (50)

Weakness: CWE-285, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/rapid7/metasploit-framework/pull/16989 technical-description