PT-2023-13727 · Italtel · Italtel Netmatch-S Ci

Fabio Romano + 3 · Published 2023-01-27 · Updated 2025-03-28 · CVE-2022-39811

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Italtel NetMatch-S CI version 5.2.0-20211008

Description The issue concerns incorrect Access Control. Specifically, it affects the "NMSCI-WebGui/advancedsettings.jsp" and "NMSCI-WebGui/SaveFileUploader" endpoints. This allows an attacker to view unauthorized pages and modify system configuration by bypassing controls without verifying user identity.

Recommendations For Italtel NetMatch-S CI version 5.2.0-20211008, consider restricting access to the "NMSCI-WebGui/advancedsettings.jsp" and "NMSCI-WebGui/SaveFileUploader" endpoints until a proper fix is available. Additionally, ensure that all system configurations are monitored closely for unauthorized changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-39811

Affected Products

Italtel Netmatch-S Ci

References · 4

• 🔥 https://gruppotim.it/it/footer/red-team.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39811 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39811 · Vendor Advisory
• https://t.me/cvenotify/116851 · Telegram Post