What is CVE-2022-37680?

CVE-2022-37680 is a high-severity vulnerability in Hitachi Hc-Ip9100hd, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2022-08-29.

How severe is CVE-2022-37680?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Hitachi Hc-Ip9100hd

CVE-2022-37680

An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system (Camera, Decoder and Encoder) and bellow allows attckers to remotely reboot the device via a crafted POST request to the endpoint /ptipupgrade.cgi. Security information ID hitachi-sec-2022-001 contains fixes for the issue.

Vulnerability class: Broken Authentication

EPSS: 0.008 (52.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

hirt@hitachi.co.jp (broken-link, third-party-advisory)
hirt@hitachi.co.jp (vendor-advisory)

Frequently asked questions

What is CVE-2022-37680?: CVE-2022-37680 is a high-severity vulnerability in Hitachi Hc-Ip9100hd, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2022-08-29.
How severe is CVE-2022-37680?: High severity. CVSS v3 base score is 7.5 out of 10.