PT-2022-19099 · Linkplay · Linkplay Sdk

Hidden · Published 2022-05-31 · Updated 2022-12-09 · CVE-2022-28605

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linkplay SDK version 1.00

Description The issue concerns a hardcoded admin token in SoundBar apps using the Linkplay SDK, allowing remote attackers to gain admin privilege access.

Recommendations For Linkplay SDK version 1.00, consider removing or modifying the hardcoded admin token to prevent unauthorized access. As a temporary workaround, restrict access to the admin interface until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-28605

Affected Products

Linkplay Sdk

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-28605 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28605 · Vendor Advisory
• https://gist.github.com/zachi40/1f8d174939684c07f5e32ee039ce9acf · Note