High severity · published Jun 13, 2022
CVE-2022-28704
Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to log in with the root privilege and perform an arbitrary…
7.2
CVSS
2.7%
EPSS
No
On KEV
Description
Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to log in with the root privilege and perform an arbitrary operation if the product is in its default settings in which is set to accept SSH connections from the WAN side, and is also connected to the Internet with the authentication information unchanged from the default settings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Casa · Rakuten
ap_f_v1_4_1; ap_f_v2_0_0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-28704
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-28704
Third Party Advisory
https://jvn.jp/en/jp/JVN46892984/index.html
Vendor Advisory
https://network.mobile.rakuten.co.jp/information/news/product/1033/
More from Casa
9.8
CVE-2022-29525
Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in with the root privilege and perform an…
7.5
CVE-2022-26834
Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to obtain the information stored in the product because the…