High severity · published Sep 26, 2022
CVE-2022-36159
Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow
8.8
CVSS
1%
EPSS
No
On KEV
Description
Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As the password strength is weak, it can be cracked in few minutes. Through this credential, a malicious actor can access the Wireless LAN Manager interface and open the telnet port then sniff the traffic or inject any malware.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fxa2000 Firmware · Contec
before 1.39.00 · source: NVD
FF
Fxa3000 Firmware · Contec
through 1.13.00 · source: NVD
FF
Fxa3020 Firmware · Contec
through 1.13.00 · source: NVD
FF
Fxa3200 Firmware · Contec
through 1.13.00 · source: NVD