PT-2022-19980 · Ma Lighting · Ma Lighting Grandma2 Light

Published 2022-08-21 · Updated 2022-08-26 · CVE-2022-30036

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MA Lighting grandMA2 Light (affected versions not specified)

Description The issue concerns a default password for the root account, which is set to root. The vendor notes that the product was designed for use on isolated networks. Additionally, it is mentioned that the successor product, grandMA3, is not affected by this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-30036

Affected Products

Ma Lighting Grandma2 Light

References · 5

• 🔥 https://parzival.sh/posts/Pwning-a-Lighting-Console-in-a-Few-Minutes · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-30036 · Security Note
• https://malighting.com/product-archive/product/grandma2-light-120112 · Vendor Advisory
• https://t.me/cvenotify/35021 · Telegram Post
• https://t.me/cibsecurity/48468 · Telegram Post