Auth bypass in Telosalliance Omnia Mpx Node
CVE-2022-36642
A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to access users credentials which makes him able to gain initial access to the control panel with high privilege because the cleartext storage of sensitive information which can be unlatched by exploiting the LFD vulnerability.
Vulnerability class: Broken Access Control
EPSS: 0.096 (95.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Telosalliance Omnia_mpx_node
- Telosalliance Omnia_mpx_node_firmware — versions 1.5.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Product, x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-36642?
- CVE-2022-36642 is a critical-severity vulnerability in Telosalliance Omnia Mpx Node, classified under Missing Authorization. CVSS score: 9.8/10. Published 2022-09-02.
- How severe is CVE-2022-36642?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2022-36642 known to be exploited?
- 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.