Vulnerability · Published Jul 21, 2022 · Assigned by INCD
CVE-2022-34767ALLNET Gmbh - ADSL/VDSL Router inkl. Modem and Wlan Authorization Bypass
Medium 5.9
In plain English
A medium-severity security flaw in ALLNET Gmbh - ADSL/VDSL Router inkl. Modem and Wlan from ALLNET Gmbh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.6%top 49.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Web page which "wizardpwd.asp" ALLNET Router model WR0500AC is prone to Authorization bypass vulnerability – the password, located at "admin" allows changing the http[s]://wizardpwd.asp/cgi-bin. Does not validate the user's identity and can be accessed publicly.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ALLNET Gmbh | ALLNET Gmbh - ADSL/VDSL Router inkl. Modem and Wlan | Update to the latest version – before Update to the latest version* |
References
- https://www.gov.il/en/Departments/faq/cve_advisories x_refsource_MISC