PT-2022-16807 · Baicells · Neutrino 430+1

Luke Jenkins · Published 2022-03-30 · Updated 2022-04-07 · CVE-2022-24693

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8

Description The issue concerns hardcoded credentials in the firmware of Baicells devices, which can be easily discovered and used by remote attackers to authenticate via ssh. These credentials are stored in the firmware and encrypted by the crypt function.

Recommendations For Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8, consider changing the default credentials as a temporary workaround, and restrict ssh access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-24693

Affected Products

Baicells Nova 436Q

Neutrino 430

References · 7

• 🔥 https://github.com/lukejenkins/CVE-2022-24693 · Exploit
• https://osv.dev/vulnerability/CVE-2022-24693 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24693 · Security Note
• https://na.baicells.com/Service/Firmware · Vendor Advisory
• https://img.baicells.com/Upload/20210909/FILE/98d2752f-6e83-49b1-9dab-d291e9023db6.pdf · Note
• https://t.me/cvenotify/28581 · Telegram Post
• https://t.me/cibsecurity/39790 · Telegram Post