CVE-2022-42463 - Softbus_server in communication subsystem has a authenication bypass vulnerability in a callback handler function. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm packets to any remote device and executing arbitrary co ...

Back Back to CVE browser

HIGH

Softbus_server in communication subsystem has a authenication bypass vulnerability in a callback handler function. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm packets to any remote device and executing arbitrary co ...

Published Oct 14, 2022

8.8

HIGH

CVSS 3.1

EPSS 0.30%

Description

OpenHarmony-v3.1.2 and prior versions have an authenication bypass vulnerability in a callback handler function of Softbus_server in communication subsystem. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm packets to any remote device and executing arbitrary commands.

Affected products

Vendor OpenHarmony Product OpenHarmony Default
n/a
- Version
  OpenHarmony-v3.1.x-Release
  Status
  affected
  Constraints
  <=3.1.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenHarmony

n/a

Version	Status	Constraints
OpenHarmony-v3.1.x-Release	affected	<=3.1.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45536
Advisory
https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45536		Advisory
https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md		Third Party Advisory