PT-2022-19180 · Rakuten · Rakuten Casa

Hiroki Oshiro + 2 · Published 2022-06-13 · Updated 2023-08-08 · CVE-2022-28704

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rakuten Casa versions AP F V1 4 1 through AP F V2 0 0

Description The issue is related to improper access control, allowing a remote attacker to log in with root privilege and perform arbitrary operations if the product is in its default settings, accepting SSH connections from the WAN side and connected to the Internet with unchanged default authentication information.

Recommendations For Rakuten Casa versions AP F V1 4 1 and AP F V2 0 0, consider changing the default authentication information and disabling SSH connections from the WAN side to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-28704

Affected Products

Rakuten Casa

References · 7

• https://osv.dev/vulnerability/CVE-2022-28704 · Vendor Advisory
• https://network.mobile.rakuten.co.jp/information/news/product/1033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28704 · Security Note
• https://t.me/cibsecurity/44245 · Telegram Post
• https://jvn.jp/en/jp/JVN46892984/index.html · Note
• https://t.me/cvenotify/31999 · Telegram Post
• https://t.me/cvenotify/31488 · Telegram Post