Vulnerability in Oring Iap-420(+)
CVE-2022-3203
On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (58.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 58.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: +0.000
Affected products
- Oring Iap-420(+) — versions FW 2.0m
- Oringnet Iap-420
- Oringnet Iap-420\+
- Oringnet Iap-420 Firmware — versions 2.0m
- Oringnet Iap-420\+ Firmware — versions 2.0m
Weakness classification (CWE)
References
- mads.uniud.it/2022/09/lord-of-the-orings/ (Exploit, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2022-3203?
- CVE-2022-3203 is a critical-severity vulnerability in Oring Iap-420(+), classified under Hidden Functionality. CVSS score: 9.8/10. Published 2022-10-21.
- How severe is CVE-2022-3203?
- Critical severity. CVSS v3 base score is 9.8 out of 10.