PT-2022-27446 · Dragino · Dragino Lora Lg01

Published 2022-12-12 · Updated 2022-12-13 · CVE-2022-45227

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dragino Lora LG01 18ed40 IoT version 4.3.4

Description The web portal of the affected device has a directory listing at the URL "https://10.10.20.74/lib/". This directory contains a backup file that can be downloaded without any authentication, posing a security risk. The lib directory is accessible, allowing unauthorized access to sensitive information.

Recommendations For Dragino Lora LG01 18ed40 IoT version 4.3.4, restrict access to the "https://10.10.20.74/lib/" directory to prevent unauthorized downloads of the backup file. Consider implementing proper access controls and authentication mechanisms to protect sensitive data.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2022-45227

Affected Products

Dragino Lora Lg01

References · 5

• 🔥 https://sectrio.com/vulnerability-research/cve-2022-45227 · Exploit
• https://osv.dev/vulnerability/CVE-2022-45227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45227 · Security Note
• https://t.me/cvenotify/39743 · Telegram Post
• https://t.me/cibsecurity/54270 · Telegram Post