Critical severity · published Apr 20, 2022
CVE-2022-1039
The weak password on the web user interface can be exploited via HTTP or HTTPS
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of which is by default enabled on trusted interfaces. While the SSH service does not support root login, a user logging in using either of the other Linux accounts may elevate to root access using the su command if they have access to the associated password.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Da50n Firmware · Redlion
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-1039
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-1039
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-03
More from Da50n Firmware
7.8
CVE-2022-26516
Authorized users may install a maliciously modified package file when updating the device via the web user interface
6.5
CVE-2022-27179
A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource