CVE-2022-24693 Hardcoded credentials in n/a
Remote attackers can use hardcoded SSH credentials found in Baicells router firmware to gain unauthorized access and control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-24693?
CVE-2022-24693 is a critical vulnerability in n/a, published on 30 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)
Weakness: CWE-798
Which versions are affected by CVE-2022-24693?
It affects 2 products.
Products include Baicells Neutrino 430 Firmware, Baicells Nova436q Firmware.
How do I fix CVE-2022-24693?
No fix has been published for CVE-2022-24693 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-24693 being exploited?
There is no known exploitation of CVE-2022-24693 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7vmv-mpx6-985j.