Vulnerability · Published Sep 26, 2022 · Assigned by mitre

CVE-2022-36158

High 8.8

In plain English

A high-severity security flaw in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.6%top 24.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-425 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.contec.com/products-services/computer-networking/flexlan-fx/fx-accesspoint/fxa3200/feature/#section x_refsource_MISC
https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4 x_refsource_MISC
https://samy.link/blog/contec-flexlan-fxa2000-and-fxa3000-series-vulnerability-repo x_refsource_MISC
https://jvn.jp/en/vu/JVNVU98305100/ x_refsource_MISC