PT-2022-3536 · Da50N · Da50N

Ron Brash · Published 2022-04-14 · Updated 2022-05-04 · CVE-2022-1039

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DA50N (affected versions not specified)

Description The issue is related to weak password requirements on the web interface of the DA50N device. This weakness can be exploited remotely via HTTP or HTTPS, allowing an attacker to gain full access to the device. Once access is obtained, other passwords can be changed. Additionally, weak passwords on Linux accounts can be accessed via SSH or Telnet, with SSH being enabled by default on trusted interfaces. Although the SSH service does not support root login, a user can elevate to root access using the su command if they have the associated password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-521

Related Identifiers

BDU:2022-04319

CVE-2022-1039

Affected Products

Da50N

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-1039 · Security Note
• https://bdu.fstec.ru/vul/2022-04319 · Security Note
• https://t.me/cibsecurity/41182 · Telegram Post
• https://t.me/cvenotify/29211 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-104-03 · Note