PT-2024-11746 · Siklu · Siklu Tg Terragraph

Semaja2Semaja2 · Published 2024-03-17 · Updated 2024-08-27 · CVE-2022-47036

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siklu TG Terragraph devices versions prior to 2.1.1

Description The issue is related to a hardcoded root password in Siklu TG Terragraph devices, which was revealed through a brute force attack on an MD5 hash. This password can be used for "debug login" by an admin.

Recommendations For versions prior to 2.1.1, consider using newer hardware that would typically be used with firmware 2.1.1 or later, as the vulnerability is fixed in the newer hardware. At the moment, there is no information about a newer firmware version that contains a fix for this vulnerability.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-47036

Affected Products

Siklu Tg Terragraph

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-47036 · Security Note
• https://t.me/cvenotify/74145 · Telegram Post
• https://t.me/cvenotify/92344 · Telegram Post
• https://t.me/cvenotify/74111 · Telegram Post
• https://semaja2.net/2023/06/11/siklu-tg-auth-bypass.html · Note
• https://twitter.com/CVEnew/status/1769563605052129572 · Twitter Post
• https://t.me/cvenotify/74118 · Telegram Post