Vulnerability · Published Jul 17, 2022 · Assigned by INCD

CVE-2022-30622Chcnav - P5E GNSS Information disclosure

Medium 5.3

In plain English

A medium-severity security flaw in Chcnav - P5E GNSS from Chcnav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 92.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sys_username_passwd.cmd - The server loads the request clearly by default. Disclosure of hard-coded credit information within the JS code sent to the customer within the Login.js file is a strong user (which is not documented) and also the password, which allow for super-user access. Username: chcadmin, Password: chcpassword.

Affected products (as reported)

Vendor	Product	Versions
Chcnav	Chcnav - P5E GNSS	4.2 – before 4.1*

References

https://www.gov.il/en/Departments/faq/cve_advisories x_refsource_MISC