Auth bypass in Unimo Udr-Ja1604
CVE-2022-44620
Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
Vulnerability class: Broken Authentication
EPSS: 0.009 (55.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Unimo Udr-ja1604
- Unimo Udr-ja1604_firmware
- Unimo Udr-ja1608
- Unimo Udr-ja1608_firmware
- Unimo Udr-ja1616
- Unimo Udr-ja1616_firmware
- Unimo Technology Co., Ltd Udr-ja1604/udr-ja1608/udr-ja1616 — versions firmware versions 71x10.1.107112.43A and earlier
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (Vendor Advisory)
- vultures@jpcert.or.jp (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-44620?
- CVE-2022-44620 is a high-severity vulnerability in Unimo Udr-Ja1604, classified under Improper Authentication. CVSS score: 8.8/10. Published 2022-12-07.
- How severe is CVE-2022-44620?
- High severity. CVSS v3 base score is 8.8 out of 10.