PT-2021-7249 · Infiray · Infiray Iray-A8Z3

F. Lienhart + 1 · Published 2021-02-01 · Updated 2022-07-25 · CVE-2022-31210

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Infiray IRAY-A8Z3 version 1.0.957

Description An issue was discovered in the binary file /usr/local/sbin/webproject/set param.cgi, which contains hardcoded credentials to the web application. These accounts are considered backdoor accounts because they cannot be deactivated or have their passwords changed. The exploitation of this issue may allow a remote attacker to elevate their privileges.

Recommendations For Infiray IRAY-A8Z3 version 1.0.957, consider disabling access to the /usr/local/sbin/webproject/set param.cgi file until a patch is available to remove the hardcoded credentials. Restrict access to the web application to minimize the risk of exploitation. Avoid using the affected accounts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2022-04159

CVE-2022-31210

Affected Products

Infiray Iray-A8Z3

References · 7

• https://osv.dev/vulnerability/CVE-2022-31210 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04159 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-31210 · Security Note
• https://t.me/cvenotify/33703 · Telegram Post
• https://sec-consult.com/vulnerability-lab/advisory/infiray-iray-thermal-camera-multiple-vulnerabilities · Note
• https://t.me/cibsecurity/46418 · Telegram Post
• https://t.me/cvenotify/33260 · Telegram Post