CVE-2022-24693 - Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh

Back Back to CVE browser

CRITICAL

Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh

Published Mar 30, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 3.34%

Description

Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29560
Advisory
https://github.com/lukejenkins/CVE-2022-24693
x_refsource_MISCThird Party Advisory
https://img.baicells.com/Upload/20210909/FILE/98d2752f-6e83-49b1-9dab-d291e9023db6.pdf
x_refsource_MISCRelease NotesThird Party Advisory
https://na.baicells.com/Service/Firmware
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29560		Advisory
https://github.com/lukejenkins/CVE-2022-24693		x_refsource_MISCThird Party Advisory
https://img.baicells.com/Upload/20210909/FILE/98d2752f-6e83-49b1-9dab-d291e9023db6.pdf		x_refsource_MISCRelease NotesThird Party Advisory
https://na.baicells.com/Service/Firmware		x_refsource_MISCVendor Advisory