PT-2023-14716 · Aztech · Aztech Wmb250Ac Mesh Routers

Tanyeetat · Published 2023-02-22 · Updated 2025-03-17 · CVE-2022-45599

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aztech WMB250AC Mesh Routers Firmware Version 016 2020

Description The issue allows attackers to gain escalated privileges under specific conditions related to a given account's hashed password, due to PHP Type Juggling in the file /var/www/login.php.

Recommendations For Aztech WMB250AC Mesh Routers Firmware Version 016 2020, as a temporary workaround, consider restricting access to the /var/www/login.php file until a patch is available. Avoid using the login functionality in the affected firmware version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-45599

Affected Products

Aztech Wmb250Ac Mesh Routers

References · 5

• 🔥 https://github.com/ethancunt/CVE-2022-45599 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-45599 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45599 · Vendor Advisory
• https://t.me/cvenotify/115088 · Telegram Post
• https://t.me/cibsecurity/58716 · Telegram Post