Headline

CVE-2022-38394: �T�|�[�g�b�Z�L��e�B�E�Ǝ㐫�ɂ��

Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthenticated attacker to execute an arbitrary OS command.

2 years ago

CVE

Open in Source

#hard_coded_credentials #auth #telnet

CentreCOM AR260S V2 �ɂ��镡��̐Ǝ㐫�ɂ��

�A��C�h�e��V�X��
��J 2022.08.29

��Ў�舵��i�̂��A�ȉ��̐��i��Ǝ㐫�ɊY��v��܂��B

�Ǝ㐫�̊T�v

�EGUI�ݒ��ʂɂ��OS�R�}��h�C��W�F�N�V��̖�� (CWE-78) �ETelnet�ڑ��p�̔F�؏�񂪃n�[�h�R�[�h��Ă�� (CWE-798) �ETelnet�@�\��s�ł��h�L��g�ɋL�ڂ��Ă��Ȃ��B��R�}��h��݂�� (CWE-912) �ETelnet�@�\�ɂ��OS�R�}��h�C��W�F�N�V��̖�� (CWE-78)

�Ώې��i

CentreCOM AR260S V2 �� Ver.3.3.7 ��O�̃t�@�[��E�F�A�o�[�W��

�e��

��u�̑�O�҂ɂ��āA�C�ӂ�OS�R�}��h��s��\��܂��B

�΍�

CentreCOM AR260S V2 �� Ver.3.3.7�ȍ~�Ƀo�[�W��A�b�v��ĉ��B �A�b�v�f�[�g��͂��ׂẴ��[�U�[�A�J�E��g�̃p�X��[�h��ύX��Ă��B

��

�ȉ��̉��{��邱�ƂŁA�{�Ǝ㐫�̉e��y��邱�Ƃ��\�ł��B

�E��ׂẴ��[�U�[�A�J�E��g�̃p�X��[�h��f�t�H��g��ύX�� O�҂Ƀ��O�C��Ȃ��悤�A��ׂẴ��[�U�[�A�J�E��g�̃p�X��[�h��ύX�� B

�ETelnet��L��ɂ��Ȃ� ��Y��i�ł�Telnet�@�\�̗L��/��̐ݒ肪�\�ł��A��T�|�[�g�̂��߃f�t�H��g�� ɂȂ��Ă��܂��BTelnet�̓��e�i��X��p�̋@�\�ł��A��ʂ̂��q�l�͂��p�� Ȃ�܂��̂ŁA�L��Ȃ��ł��B

�E�t�@�C�A�E�H�[��@�\��g�p�� Y��i�ɂ̓t�@�C�A�E�H�[��@�\��Ă��A�f�t�H��g�ŗL��ɂȂ��Ă��܂��B �O��̈Ӑ}��Ȃ��A�N�Z�X��h��߁A�t�@�C�A�E�H�[��@�\��g�p��Ă��B

�ȏ�