CVE-2022-36159

Summary

CVE	CVE-2022-36159
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-09-26 11:15:00 UTC
Updated	2022-10-03 17:16:00 UTC
Description	Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As the password strength is weak, it can be cracked in few minutes. Through this credential, a malicious actor can access the Wireless LAN Manager interface and open the telnet port then sniff the traffic or inject any malware.

Risk And Classification

Problem Types: CWE-798

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Hardware	Contec	Fxa2000	-	All	All	All
Operating System	Contec	Fxa2000 Firmware	All	All	All	All
Hardware	Contec	Fxa3000	-	All	All	All
Operating System	Contec	Fxa3000 Firmware	All	All	All	All
Hardware	Contec	Fxa3020	-	All	All	All
Operating System	Contec	Fxa3020 Firmware	All	All	All	All
Hardware	Contec	Fxa3200	-	All	All	All
Operating System	Contec	Fxa3200 Firmware	All	All	All	All

References

Reference	Source	Link	Tags
gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4	MISC	gist.github.com
JVNVU#98305100: Multiple vulnerabilities in Contec FLEXLAN FX3000 and FX2000 series	MISC	jvn.jp
Contec FLEXLAN FXA2000 and FXA3000 series vulnerability report - Necrum Security Labs	MISC	samy.link
Overview / Features \| FXA3200 \| Simultaneous connection type Wireless LAN Access Point (Master Station) \| CONTEC	MISC	www.contec.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

591367 Contec FLEXLAN FX3000 and FX2000 series Hidden Functionality and Use of Hard-coded Credentials Multiple Vulnerabilities (JVNVU98305100)