PT-2022-22909 · Penta Security Systems Inc · Wapples

Published 2022-09-13 · Updated 2023-08-08 · CVE-2022-35582

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Penta Security Systems Inc WAPPLES versions 4.0.* through 5.0.12.*

Description The operating system that WAPPLES runs on has a built-in non-privileged user penta with a predefined password. The password for this user, as well as its existence, is not disclosed in the documentation. Knowing the credentials, attackers can use this feature to gain uncontrolled access to the device and therefore are considered an undocumented possibility for remote control.

Recommendations For versions 4.0.* through 5.0.12.*, consider changing the predefined password of the penta user to prevent unauthorized access. As a temporary workaround, restrict access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-35582

Affected Products

Wapples

References · 8

• 🔥 https://medium.com/@_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb · Exploit
• https://osv.dev/vulnerability/CVE-2022-35582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35582 · Security Note
• https://t.me/cvenotify/36454 · Telegram Post
• https://medium.com/%40_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb · Note
• https://t.me/cibsecurity/49752 · Telegram Post
• https://pentasecurity.com/product/wapples · Note
• https://t.me/cvenotify/36121 · Telegram Post