CVE-2022-47732 - Vulnerability Details - OpenCVE

In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which will change admin password granting access to the device.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Yeastar	N412 N412 Firmware N824 N824 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:yeastar:n824_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:yeastar:n824:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:yeastar:n412_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:yeastar:n412:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.swascan.com/security-advisory-yeastar-n412-and-n824-configuration-panel/
https://www.yeastar.com/n-series-analog-phone-system/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-01-20T00:00:00

Updated: 2024-08-03T15:02:36.438Z

Reserved: 2022-12-21T00:00:00

Link: CVE-2022-47732

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-01-20T17:15:10.880

Modified: 2024-11-21T07:32:22.427

Link: CVE-2022-47732

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:yeastar:n824_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "5E3C0C40-FF41-4FA7-9D1A-5CC26CE703EE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:yeastar:n824:-:*:*:*:*:*:*:*", "matchCriteriaId": "5CAA0551-5F64-4039-985C-264AE0BCF624", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:yeastar:n412_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "70CF7C44-A1C9-4452-BF18-F6DCF6923597", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:yeastar:n412:-:*:*:*:*:*:*:*", "matchCriteriaId": "94B68D27-784F-4B18-BAC4-3A4AC7F16249", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which will change admin password granting access to the device."}, {"lang": "es", "value": "En Yeastar N412 y N824 Configuration Panel 42.x y 45.x, un atacante no autenticado puede crear un archivo de respaldo y descargarlo, revelando el hash de administrador, permitiendo, una vez descifrado, iniciar sesi\u00f3n dentro del Panel de configuraci\u00f3n; de lo contrario, reemplazando el hash en el archivo. y restaurarlo en el dispositivo, lo que cambiar\u00e1 la contrase\u00f1a de administrador y otorgar\u00e1 acceso al dispositivo."}], "id": "CVE-2022-47732", "lastModified": "2024-11-21T07:32:22.427", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-20T17:15:10.880", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://www.swascan.com/security-advisory-yeastar-n412-and-n824-configuration-panel/"}, {"source": "cve@mitre.org", "tags": ["Product", "Vendor Advisory"], "url": "https://www.yeastar.com/n-series-analog-phone-system/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://www.swascan.com/security-advisory-yeastar-n412-and-n824-configuration-panel/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Vendor Advisory"], "url": "https://www.yeastar.com/n-series-analog-phone-system/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-916"}], "source": "nvd@nist.gov", "type": "Primary"}]}