IPTIME NAS family CSRF vulnerability
CVE-2022-23765

8HIGH

Key Information:

Vendor

Efm Networks Co.,ltd

Status
Nas1dual, Nas2dual, Nas4dual
Vendor
CVE Published:
17 August 2022

What is CVE-2022-23765?

This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.

Affected Version(s)

NAS1dual, NAS2dual, NAS4dual Linux, Windows and etc.. < 1.4.86

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin...
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.