PT-2024-31203 · Shenzhen Haichangxing Technology Co. · Hcx H822 4G Lte Router

Published 2024-09-10 · Updated 2024-10-29 · CVE-2024-44667

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shenzhen Haichangxing Technology Co., Ltd HCX H822 4G LTE Router version M7628NNxISPxUIv2 v1.0.1557.15.35 P0

Description The issue is related to Incorrect Access Control, allowing unauthenticated factory mode reset and command injection. This leads to information exposure and root shell access.

Recommendations For version M7628NNxISPxUIv2 v1.0.1557.15.35 P0, as a temporary workaround, consider restricting access to the router's factory mode reset and command injection functionalities until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-44667

Affected Products

Hcx H822 4G Lte Router

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-44667 · Security Note
• https://twitter.com/CVEnew/status/1833549096608796937 · Twitter Post
• https://medium.com/%40sengkyaut/unauthenticated-factory-mode-reset-and-at-command-injection-in-jboneos-or-jbonecloud-firmware-1dec156b7ddd · Note
• http://shenzhen.com · Note
• https://t.me/cvedetector/5276 · Telegram Post