PT-2022-4624 · Centrecom · Centrecom Ar260S V2

Published 2022-08-29 · Updated 2022-09-13 · CVE-2022-38394

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7

Description The issue is related to the use of hard-coded credentials for the telnet server, allowing a remote unauthenticated attacker to execute an arbitrary OS command. This could potentially give an attacker access to sensitive information.

Recommendations For CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7, update to version Ver.3.3.7 or later to resolve the issue. As a temporary workaround, consider disabling the telnet server until a patch is available. Restrict access to the telnet server to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2022-05505

CVE-2022-38394

Affected Products

Centrecom Ar260S V2

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-38394 · Security Note
• https://allied-telesis.co.jp/support/list/faq/vuls/20220829.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38394 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20220901.21.pdf · Security Note
• https://bdu.fstec.ru/vul/2022-05505 · Security Note
• https://t.me/cvenotify/35847 · Telegram Post
• http://jvn.jp/en/jp/JVN45473612/index.html · Note
• https://jvn.jp/en/jp/JVN45473612/index.html · Note