CVE-2022-27632 Cross-site request forgery in Rebooter, PoE Rebooter, Scheduler, and Contact Converter
Remote attackers can hijack administrator sessions and perform arbitrary operations via CSRF in MEIKYO ELECTRIC rebooters and schedulers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-27632?
CVE-2022-27632 is a high-severity vulnerability in MEIKYO ELECTRIC CO.,LTD. Rebooter, PoE Rebooter, Scheduler, and Contact Converter, published on 18 May 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware versions, WATCH BOOT L-zero RPC-M4L [End of Sale] all firmware versions, WATCH BOOT mini RPC-M4H [End of Sale] all firmware versions, WATCH BOOT nino RPC-M2CS firmware version 1.00A to 1.00D, WATCH BOOT light RPC-M5CS firmware version 1.00A to 1.00D, WATCH BOOT L-zero RPC-M4LS firmware version 1.00A to 1.20A, and Signage Rebooter RPC-M4HSi firmware version 1.00A), PoE Rebooter(PoE BOOT nino PoE8M2 firmware version 1.00A to 1.20A), Scheduler(TIME BOOT mini RSC-MT4H [End of Sale] all firmware versions, TIME BOOT RSC-MT8F [End of Sale] all firmware versions, TIME BOOT RSC-MT8FP [End of Sale] all firmware versions, TIME BOOT mini RSC-MT4HS firmware version 1.00A to 1.10A, and TIME BOOT RSC-MT8FS firmware version 1.00A to 1.00E), and Contact Converter(POSE SE10-8A7B1 firmware version 1.00A to 1.20A) allows a remote attacker to hijack the authentication of an administrator and conduct arbitrary operations by having a user to view a specially crafted page.
Weakness: CWE-352
Which versions are affected by CVE-2022-27632?
It affects 15 products.
Products include Meikyo Poe Boot Nino Poe8m2 Firmware, Meikyo Pose Se10-8a7b1 Firmware, Meikyo Signage Rebooter Rpc-M4hsi Firmware, Meikyo Time Boot Mini Rsc-Mt4h Firmware, Meikyo Time Boot Mini Rsc-Mt4hs Firmware, Meikyo Time Boot Rsc-Mt8f Firmware and 9 more.
How do I fix CVE-2022-27632?
No fix has been published for CVE-2022-27632 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-27632 being exploited?
There is no known exploitation of CVE-2022-27632 in the wild and no public exploit code.
Other vulnerabilities in MEIKYO ELECTRIC CO.,LTD. Rebooter, PoE Rebooter, Scheduler, and Contact Converter
Sources
Also known as GHSA-qgj5-3w7x-wf28.