CVE-2022-30622 Chcnav - P5E GNSS Information disclosure
Hardcoded credentials and exposed API allow attackers to gain super-user access and view sensitive data on Chcnav P5E GNSS devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-30622?
CVE-2022-30622 is a medium-severity vulnerability in Chcnav - P5E GNSS, published on 17 Jul 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sys_username_passwd.cmd - The server loads the request clearly by default. Disclosure of hard-coded credit information within the JS code sent to the customer within the Login.js file is a strong user (which is not documented) and also the password, which allow for super-user access. Username: chcadmin, Password: chcpassword.
Weakness: CWE-798
Which versions are affected by CVE-2022-30622?
It affects 1 product.
Products include Chcnav P5e Gnss Firmware.
How do I fix CVE-2022-30622?
No fix has been published for CVE-2022-30622 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-30622 being exploited?
There is no known exploitation of CVE-2022-30622 in the wild and no public exploit code.
Other vulnerabilities in Chcnav - P5E GNSS
- CVE-2022-30624 Chcnav - P5E GNSS Authentication bypass admin password reset
- CVE-2022-30626 Chcnav - P5E GNSS API not secure
- CVE-2022-30623 Chcnav - P5E GNSS Authentication bypass
- CVE-2022-30625 Chcnav - P5E GNSS Directory listing
- CVE-2022-30627 Chcnav - P5E GNSS Information disclosure hard coded credentials.
Sources
Also known as GHSA-mjhj-9f4w-v2vv.